CVE-2026-45140: Improper Limitation of a Pathname to a Restricted Directory

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...

CVE-2026-92993: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

CVE-2026-54617: Improper Limitation of a Pathname to a Restricted Directory

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in...

CVE-2026-92927: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /db/drugrecommendor.sql. Performing a manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit has been made...

CVE-2026-92926: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partnerpreference.php. Such manipulation of the argument education leads to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-92881: Divide By Zero

A security vulnerability has been detected in vgmstream. The affected element is the function initvgmstreamawbmemory of the file src/meta/awb.c of the component AWB parser. Such manipulation leads to divide by zero. The attack can be executed remotely. The name of the patch is...

CVE-2026-26950: Insufficient Verification of Data Authenticity

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-92915: Allocation of Resources Without Limits or Throttling

WWBN AVideo through commit e01e41ecc no patched version available contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement $global'ignoreUserMustBeLoggedIn' = 1, takes usersid directly from the query string, and calls User::sendVerificationLi...

CVE-2026-92860: Improper Input Validation

A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. Th...

PT-2026-95181

Name of the Vulnerable Software and Affected Versions Microsoft Fabric affected versions not specified Description An authentication bypass by spoofing exists in Microsoft Fabric. This issue allows an unauthenticated remote attacker to provide crafted identity assertions that are accepted as...

PT-2026-94339

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description A Server-Side Request Forgery SSRF issue exists where a low privileged attacker with remote access could potentially exploit the system to induce the server to make...

CVE-2026-93387: Improper Check for Unusual or Exceptional Conditions

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

PT-2026-94230

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description An Improper Neutralization of Special Elements used in an OS Command, known as OS Command Injection, allows an unauthenticated remote attacker to execute arbitrary...

CVE-2026-92925: Out-of-bounds Read

A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-carrying extensions for null-termination. This oversight allows a remote attacker to craft a malicious packet, leading to an out-of-bounds...

PT-2026-95164

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description In prefill/decode disaggregated deployments, the software fails to properly clean up decode-side metadata for rejected inference requests. A remote attacker can submit multiple requests using the max...

CVE-2026-93379: Incorrect Authorization

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-93307: Memory Allocation with Excessive Size Value

A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to...

CVE-2026-93386: User Interface (UI) Misrepresentation of Critical Information

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-54510: Improper Authentication

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrfexemptforapitokens beforerequest hook in src/app.py calls csrf.exemptviewfunc, permanently adding the selected view to Flask-WTF's process-global exemption set. The...

PT-2026-94290

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description A Cross-Site Request Forgery CSRF issue exists where an unauthenticated attacker with remote access could potentially execute commands remotely. CSRF is a flaw that...