CVE-2026-0197: Exposure of Sensitive Information to an Unauthorized Actor

In VPU, there is a possible information dislclosure due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0179: Improper Privilege Management

In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-90846: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

School Registration and Fee System SQL Injection Vulnerability (CNVD-2026-37879)

School Registration and Fee System is a school registration and fee management software developed by the SourceCodester community. The system has a SQL injection vulnerability, which stems from incorrect handling of the period parameter in the file bilal/normal/payreport.php. Attackers can exploi...

CVE-2026-54337: Improper Neutralization of Argument Delimiters in a Command

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue...

PT-2026-92294

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the addr remap address map function within the remap.c file allows for a local escalation of privilege. An attacker can exploit this issue to ga...

PT-2026-93091

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description A flaw in the Core component of Oracle VM VirtualBox on Windows hosts allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system...

PT-2026-91845

A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used...

PT-2026-92338

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A missing bounds check in multiple locations allows for a possible out-of-bounds write, which is a condition where data is written outside the intended memory...

PT-2026-92293

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the code allows for a permission bypass in multiple locations. This issue can lead to local escalation of privilege, granting System execution...

PT-2026-92286

In gsa sw pk hash compare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PT-2026-92670

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise FIN Inventory Brazil version 9.1 Description A flaw in the Inventory component allows a low privileged attacker with access to the infrastructure where the software executes to compromise the system...

PT-2026-91777

A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and m...

PT-2026-93089

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description A flaw in the Core component of Oracle VM VirtualBox on Windows hosts allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system...

PT-2026-93090

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description A flaw in the Core component of Oracle VM VirtualBox on Windows hosts allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37981)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from incorrect handling of the parameter “firstname” in the...

PT-2026-92648

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Sales Online versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of Oracle Sales Online allows a low privileged attacker with network access via HTTP to compromise the system...

PT-2026-92705

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Configuration Tools. Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Siebel CRM Development. Successf...

PT-2026-92673

Name of the Vulnerable Software and Affected Versions Oracle Application Testing Suite version 13.3.0.1 Description An unauthenticated attacker with access to the infrastructure where the software executes can compromise the system. This issue requires human interaction from a person other than t...

CVE-2026-90854: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The...