CVE-2026-64960

ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...

CVE-2026-64960 Remote Code Execution via Unrestricted File Upload in ATutor

ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...

CVE-2026-64960 Remote Code Execution via Unrestricted File Upload in ATutor

ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...

MINI-78J4-2M23-XQ2F

Bulletin has no description...

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

A now-patched security flaw impacting Zimbra Collaboration ZCS has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team CERT Polska. The vulnerability in question is CVE-2026-73570 CVSS score: 8.9, which refers to a case of command injection that ca...

CVE-2026-76988

A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forwardopen of the file cipconnectionmanager.cc of the component ForwardOpen Handler. Executing a manipulation of the argument productcode can lead to...

CVE-2026-76987

A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Performing a manipulation results in memory...

CVE-2026-76990 code-projects Simple Inventory System delete.php sql injection

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public...

EUVD-2026-63348

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public...

CVE-2026-76990

A proof-of-concept exploit exists for CVE-2026-76990, a SQL injection in the ID argument of /delete.php in code-projects Simple Inventory System 1.0, exploitable remotely without authentication (CVSS 7.3 HIGH). No patch or workaround is mentioned in the provided documents.

MAL-2026-14319 Malicious code in test-flow-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e7f0fbad80f9bdcba1c9d37322137d8f3a7bd86353650c5f946c73b1bb4637 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14318 Malicious code in frenchworldcupwin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f28b41919d402aff87ec13d36b2419e4c19dcc209dcb6ffa3e736de5be2803e6 package.json declares its sole runtime dependency client-marker-packet-cluster as an arbitrary HTTPS tarball URL on a non-registry host...

EUVD-2026-63347

A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enetencap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to out-of-bounds read. The attack can be...

CVE-2026-76989

A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enetencap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to out-of-bounds read. The attack can be...

EUVD-2026-63346

A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forwardopen of the file cipconnectionmanager.cc of the component ForwardOpen Handler. Executing a manipulation of the argument productcode can lead to...

CVE-2026-76988

CIPster's ForwardOpen handler in cipconnectionmanager.cc reads attacker-controlled product_code_ without bounds checking, causing an out-of-bounds read exploitable remotely with no authentication. CVSS 5.3 (MEDIUM) impact is availability only. Public proof-of-concept exploit exists; apply patch e...

CVE-2026-76988 liftoff-sr CIPster ForwardOpen cipconnectionmanager.cc forward_open out-of-bounds

A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forwardopen of the file cipconnectionmanager.cc of the component ForwardOpen Handler. Executing a manipulation of the argument productcode can lead to...

CVE-2026-77084

n8n before 1.123.69 and 2.x before 2.33.4 / 2.34.1 contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value wou...

CVE-2026-77068

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating...

CVE-2026-76987 liftoff-sr CIPster Generic Attribute Logic ciptypes.h SetAttrData memory corruption

A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Performing a manipulation results in memory...