EUVD-2026-63393

A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/admin/vieworder.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released ...

CVE-2026-55192

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can provide a specially crafted H.264 video stream that causes the client's H.264 decoder to read beyond its allocated memory. This out-of-bounds read can lead to the disclosure of sensitive client memory or cause the...

CVE-2026-76928

A flaw was found in Wireshark. A remote attacker could exploit a NULL pointer dereference vulnerability in the X.509IF protocol dissector. This could lead to a denial of service, making the application unavailable to legitimate users...

EUVD-2026-63392

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-bas...

CVE-2026-76995 SourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted upload

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=savemenu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. Th...

CVE-2026-76995

The description states the exploit is publicly available but no exploit code or proof-of-concept is included in the provided documents, so actual exploitation status cannot be confirmed here.

EUVD-2026-63391

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=savemenu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. Th...

EUVD-2026-63388

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow...

CVE-2026-16928

IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 contain a heap-based buffer overflow exploitable remotely without authentication, causing denial of service (CVSS 7.5 HIGH, impact limited to availability). IBM's support page is linked as the primary reference. No exploitation or patch details are provided ...

CVE-2026-16926

CVE-2026-16926 is classified as CWE-73 (External Control of File Name or Path) in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, allowing a remote unauthenticated attacker to overwrite arbitrary files. Fixes are available via AIX Service Packs (7.2 TL05 SP13, 7.3 TL02 SP05, TL03 SP03, TL04 SP02) and V...

EUVD-2026-63386

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of special elements in input...

CVE-2026-16924 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset during IPsec decapsulation...

CVE-2026-44725

In EMQX versions prior to 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, missing five-minute grant lifetime and SHA-256 package binding let a compromised admin/API key upload attacker-controlled Erlang code via POST /api/v5/plugins/install, achieving remote code execution. Patched in all listed ...

EUVD-2026-63381

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3, 5.10.4, 6.0.3, 6.1.2, and 6.2.1, the plugin-install REST API and dashboard upload accepted stale grants created with emqx ctl plugins allow because there was no five-minute gran...

EUVD-2026-63377

A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of the argument Traceback can lead to injection. The attack can be executed remotely. A high complexity level is associated with...

CVE-2026-76993

GreyDGL PentestGPT up to 1.0.0 has an injection flaw in the Web-Page Crawling component, triggered by manipulating a Traceback argument. The exploit is remotely exploitable with high complexity, has a public PoC, and the vendor closed the GitHub issue as "not planned" with no patch indicated. Exp...

CVE-2026-76993 GreyDGL PentestGPT Web-Page Crawling injection

A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the component Web-Page Crawling. Executing a manipulation of the argument Traceback can lead to injection. The attack can be executed remotely. A high complexity level is associated with...

CVE-2026-64966

ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This allows an attacker to place a...

CVE-2026-64960

ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a valid courseid can upload a...

EUVD-2026-63375

A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /viewappointmentapproved.php. Performing a manipulation of the argument delid results in sql injection. Remote exploitation of the attack is possible. The exploit has been made publi...