CVE-2026-2682 Tsinghua Unigroup Electronic Archives System prinReport.html sql injection

A vulnerability has been found in Tsinghua Unigroup Electronic Archives System up to 3.2.21080262532. Impacted is an unknown function of the file /mine/PublicReport/prinReport.html?token=java. Such manipulation of the argument comid leads to sql injection. The attack can be launched remotely. The...

CVE-2026-2661

A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be...

CVE-2026-2661

A security flaw has been discovered in Squirrel up to 3.2. This affects the function SQObjectPtr::operator in the library squirrel/sqobject.h. The manipulation results in heap-based buffer overflow. The attack needs to be approached locally. The exploit has been released to the public and may be...

CVE-2026-2665

The CVE refers to huanzi-qch base-admin (up to commit 57a8126bb3353a004f3c7722089e3b926ea83596) with a vulnerability in the Upload function of SysFileController.java (JSP Parser component) that allows unrestricted file upload via manipulation of the File argument. Exploitation is remote and the e...

CVE-2026-2662 FascinatedBox lily lily_emitter.c count_transforms out-of-bounds

A weakness has been identified in FascinatedBox lily up to 2.3. This vulnerability affects the function counttransforms of the file src/lilyemitter.c. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and could ...

CVE-2026-2658

A vulnerability was found in newbee-ltd newbee-mall up to a069069b07027613bf0e7f571736be86f431faee. Affected is an unknown function of the component Multiple Endpoints. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-2659

A vulnerability was determined in Squirrel up to 3.2. Affected by this vulnerability is the function SQFuncState::PopTarget of the file src/squirrel/squirrel/sqfuncstate.cpp. Executing a manipulation of the argument targetstack can lead to out-of-bounds read. It is possible to launch the attack o...

CVE-2026-2659 Squirrel sqfuncstate.cpp PopTarget out-of-bounds

A vulnerability was determined in Squirrel up to 3.2. Affected by this vulnerability is the function SQFuncState::PopTarget of the file src/squirrel/squirrel/sqfuncstate.cpp. Executing a manipulation of the argument targetstack can lead to out-of-bounds read. It is possible to launch the attack o...

CVE-2026-2658

The CVE affects the newbee-ltd newbee-mall project (up to a069069b07027613bf0e7f571736be86f431faee) with an issue in the Unknown function of the Multiple Endpoints component. The described impact is cross-site request forgery (CSRF) arising from a manipulation of that function, with remote exploi...

CVE-2026-2657 wren-lang wren Error Message wren_compiler.c printError stack-based overflow

A vulnerability has been found in wren-lang wren up to 0.4.0. This impacts the function printError of the file src/vm/wrencompiler.c of the component Error Message Handler. Such manipulation leads to stack-based buffer overflow. An attack has to be approached locally. The exploit has been disclos...

UBUNTU-CVE-2025-71234

In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxustaadd The driver does not set hw-stadatasize, which causes mac80211 to allocate insufficient space for driver private station data in stainfoalloc. When rtl8xxxustaadd accesses...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in getContent in ActionReportResultHtmlProvider.java‎, which is accessible via the REST Management Interface. An attacker can cause an administrator to change the admin password by convincing them to follow a...

CVE-2026-2247

SQL injection vulnerability SQLi in Clicldeu SaaS, specifically in the generation of reports, which occurs when a previously authenticated remote attacker executes a malicious payload in the URL generated after downloading the student's report card in the ‘Day-to-day’ section from the mobile...

CVE-2026-2642

A security vulnerability has been detected in ggreer thesilversearcher up to 2.2.0. The impacted element is the function searchstream of the file src/search.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed...

CVE-2026-2641 universal-ctags V Language v.c parseExprList recursion

A weakness has been identified in universal-ctags ctags up to 6.2.1. The affected element is the function parseExpression/parseExprList of the file parsers/v.c of the component V Language Parser. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack on t...

AZL-78027 CVE-2026-27171 affecting package teckit 2.5.12-4

zlib before 1.3.2 allows CPU consumption via crc32combine64 and crc32combinegen64 because x2nmodp can do right shifts within a loop that has no termination condition...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the crc32combinegen64 function. An attacker can cause excessive CPU consumption by providing negative argument that triggers a loop with no termination condition. Remediation Upgrade zlib to version 1.3.2 or higher...

OSV-2026-259 Use-of-uninitialized-value in tsip_parse_input

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=484859694 Crash type: Use-of-uninitialized-value Crash state: tsipparseinput gpsdpoll FuzzDrivers.c...

PT-2026-20486

A weakness has been identified in FascinatedBox lily up to 2.3. This vulnerability affects the function count transforms of the file src/lily emitter.c. This manipulation causes out-of-bounds read. The attack can only be executed locally. The exploit has been made available to the public and coul...

PT-2026-20476

Name of the Vulnerable Software and Affected Versions newbee-ltd newbee-mall affected versions not specified Description A flaw exists in newbee-ltd newbee-mall. This issue involves a function within the Multiple Endpoints component that can be exploited to perform cross-site request forgery...