CVE-2026-90879: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

CVE-2026-68953: Missing Authentication for Critical Function

The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTPS requests...

Linux Distros Unpatched Vulnerability : CVE-2026-90848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a...

CVE-2026-91849: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the component Avatar Upload. The manipulation of the argument File results in unrestricted upload. The attack can be executed remotely. Th...

CVE-2026-90854: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The...

PT-2026-93184

Name of the Vulnerable Software and Affected Versions a2ui-project a2ui versions prior to 0.10.7 Description A remote attack can be launched against the Basic Catalog component due to inefficient regular expression complexity within an unknown function in the file renderers/web core/src/v0 9/basi...

CVE-2026-12752: Improper Restriction of XML External Entity Reference

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resource...

CVE-2026-76697: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially...

CVE-2026-91089: Use After Free

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gfnodegetnameandid of the file scenegraph/basescenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version...

CVE-2026-91091: Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gfnodelistinsertchild of the file scenegraph/basescenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly...

CVE-2026-52823: Cross-Site Request Forgery (CSRF)

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...

PT-2026-91857

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chat template causes resource consumption. The attack can be initiated remotely. The exploit...

CVE-2026-85234: Out-of-bounds Read

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring function. This leads to out-of-bounds read/write operations. A remote, unauthenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-90852

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.ja...

PT-2026-93167

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.47 Description A use after free issue exists in Workers, which could allow a remote attacker to potentially execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page...

D-Link DIR-878 SetWan3Settings Component Data Compromise

The vulnerability of the SetWan3Settings function in the WAN Settings component of the D-Link DIR-878 wireless router’s microprogramming system is related to the output of operations that go beyond the buffer in memory. Exploiting this vulnerability could allow a remote attacker to compromise the...

CVE-2026-90842 PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

CVE-2026-90842 PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

CVE-2026-90841

A SQL injection vulnerability in PHPGurukul Blood Donor Management System 1.0 affects the Report Endpoint (file /application/controllers/admin/Report.php). Manipulating the fromdate/todate arguments allows a remote, unauthenticated attacker to inject SQL, potentially compromising confidentiality,...

CVE-2026-90841 PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...