CVE-2026-90807 nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following

A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. The attack may be performed from remote. The...

CVE-2026-90807 nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following

A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. The attack may be performed from remote. The...

CVE-2026-90807

CVE-2026-90807 is a link following vulnerability in nanocoai NanoClaw (up to version 2.1.17 ), located in the function forwardAttachedFiles within the file src/modules/agent-to-agent/agent-route.ts of the Attachment Handler component. A remote attacker with low privileges can exploit this without...

EUVD-2026-77704

A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link following. The attack may be performed from remote. The...

CVE-2026-90806 DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...

CVE-2026-90806

CVE-2026-90806 is a missing authorization vulnerability in DjangoCRM django-crm (versions up to 1.2), specifically in the BulkUpdateCasesView function within backend/cases/bulk_views.py (component: Bulk Case Update). An attacker with low privileges can exploit this remotely without user interacti...

EUVD-2026-77695

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...

CVE-2026-90806 DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...

CVE-2026-90806 DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...

CVE-2026-90796

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-90805 subhajitkhan online-clinic-management-system doctorlogin.php sql injection

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument docmail/docpswd can lead to sql injection. The attack can be executed remotely...

CVE-2026-90805

A SQL injection vulnerability exists in the doctorlogin.php file of subhajitkhan online-clinic-management-system (a GitHub-hosted project). By manipulating the doc_mail and doc_pswd arguments, an unauthenticated remote attacker can inject SQL commands. The CVSS 3.1 score is 7.3 (High) with low im...

EUVD-2026-77681

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument docmail/docpswd can lead to sql injection. The attack can be executed remotely...

redis: Redis: Arbitrary code execution via TLS pending-data list use-after-free

A flaw was found in Redis. This vulnerability, a use-after-free, exists within the tlsProcessPendingData function, which manages the Transport Layer Security TLS pending-data list when Redis is configured with TLS support. A remote, unauthenticated attacker could exploit this to execute...

OESA-2026-3745 nmap security update

Nmap "Network Mapper" is a free and open source license utility for network discovery and security \ auditing. It was designed to rapidly scan large networks, but works fine against single hosts. Security Fixes: Nmap versions up to and including 7.99 contains a denial of service vulnerability tha...

CVE-2026-90793

A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gfnodegetname of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may b...

CVE-2026-90794

A vulnerability was found in GPAC up to f1219cde. The affected element is the function gfsgscriptload of the file scenegraph/vrmltools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public a...

CVE-2026-90792

A flaw has been found in GPAC up to f1219cde. This issue affects the function gfnodelistgetchild of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploi...

CVE-2026-90796

itsourcecode Leave Management System 1.0 contains a SQL injection vulnerability in the file /module/company/index.php , triggered by manipulating the ID argument. The attack is remotely exploitable and requires low privileges with no user interaction. Impact is rated MEDIUM (CVSS 3.1 score 6.3), ...

CVE-2026-90796 itsourcecode Leave Management System index.php sql injection

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...