CVE-2026-92364 itsourcecode Leave Management System index.php sql injection

A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...

CVE-2026-92364

itsourcecode Leave Management System 1.0 is affected by a SQL injection vulnerability in the file /module/employee/index.php, where manipulation of the ID argument allows an attacker to inject SQL commands. The attack can be initiated remotely and requires low privileges (authenticated access), w...

CVE-2026-92463

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

CVE-2026-92463 yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

CVE-2026-92463 yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

CVE-2026-84408

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...

CVE-2026-27552

CVE-2026-27552 is a high-severity vulnerability (CVSS 3.1: 8.1) involving improper authorization in the /index.php/attached_devices_tab/do_upload endpoint. A low-privileged remote attacker can exploit this flaw to upload IODD files to the device, potentially altering device behavior or causing sy...

CVE-2026-27552 Unauthorized IODD File Upload due to Improper Authorization

A low-privileged remote attacker can exploit improper authorization in the /index.php/attacheddevicestab/doupload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes...

CVE-2026-27552 Unauthorized IODD File Upload due to Improper Authorization

A low-privileged remote attacker can exploit improper authorization in the /index.php/attacheddevicestab/doupload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes...

EUVD-2026-80235

A low-privileged remote attacker can exploit improper authorization in the /index.php/attacheddevicestab/doupload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes...

CVE-2026-84408

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...

CVE-2026-84408

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...

CVE-2026-84408

QND (a client by QualitySoft ) contains an improper access control vulnerability in a named pipe . A local attacker with an existing logon session on an affected Windows PC can exploit this to execute arbitrary commands with SYSTEM privileges , leading to high impact on confidentiality, integrity...

EUVD-2026-80227

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...

Multiple vulnerabilities in QND

Overview QND Standard/Premium provided by QualitySoft Corporation contains multiple vulnerabilities listed below: Use of hard-coded cryptographic key CWE-321 - CVE-2026-81326 Improper access control on a named pipe CWE-782 - CVE-2026-84408 Taisei Ogura of MOTEX Inc. reported this vulnerability to...

kernel-rt security update

An update is available for kernel-rt. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel-rt packages provide the Real Time Linux Kernel, which enables...

RLSA-2026:67468 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: EDAC/bluefield: Fix potential integer overflow CVE-2024-53161 kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address CVE-2025-71127 kernel: KVM: nSVM: Always use vmcb01 in...

kernel: rxrpc: Fix potential UAF after skb_unshare() failure

A flaw was found in the Linux kernel's rxrpc subsystem. This vulnerability arises when the system attempts to unshare a packet buffer, and the operation fails due to an allocation issue. This failure can lead to a Use-After-Free UAF condition, where the system attempts to access memory that has...

kernel: rxrpc: Fix potential UAF after skb_unshare() failure

A flaw was found in the Linux kernel's rxrpc subsystem. This vulnerability arises when the system attempts to unshare a packet buffer, and the operation fails due to an allocation issue. This failure can lead to a Use-After-Free UAF condition, where the system attempts to access memory that has...

EUVD-2026-80052

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE component: Compiler. The supported version that is affected is Oracle GraalVM for JDK 17: 23.0.13.1; Oracle GraalVM for JDK 21: 23.1.12.1; Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows...