PT-2026-93740

A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...

CVE-2026-92463: Missing Authorization

yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out, allowing authenticated back-office users without system:user:list permission to enumerate all users. Attackers with valid back-office...

CVE-2026-14349: Missing Authorization

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

PT-2026-93345

A low-privileged remote attacker can exploit improper authorization in the /index.php/attached devices tab/do upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37975)

Sales and Inventory System is a sales and inventory management enterprise resource planning system developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability. This vulnerability stems from the lack of validation for external SQL statements in the parameter ID with...

PT-2026-93603

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A logic flaw exists in the merge memory ranges function within the powerpc/kexec file component. The function incorrectly handles overlapping memory ranges by comparing the current range...

PT-2026-93453

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the MES scheduler ring is skipped by the force-completion loop in the amdgpu device pre asic reset function because it lacks a drm...

PT-2026-93440

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where preemption is not properly disabled during the execution of the bpf get stackid function. Specifically, the get perf callchain call requires...

PT-2026-93501

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the scsi qla2xxx driver where the functions qla nvme fcp abort and qla nvme ls abort call INIT WORK on the priv-abort work variable immediately before schedule work...

CVE-2026-92366: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. This manipulation of the argument sex/mothertongue/maritialstatus/country/state/religion/agemin/agemax causes sql injection. The attack can...

PT-2026-94109

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.8.0 through 4.18.5 Craft CMS versions 5.0.0 through 5.10.12 Description An issue exists where the software signs an authenticated user's attacker-controlled license-shun cookie using the same key and format used to validat...

PT-2026-93683

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ceph component where the ceph fname to usr function fails to account for buffers allocated in the vmalloc region. The fscrypt subsystem requires buffers to be in t...

PT-2026-93869

A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /index.php. Such manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been...

Linux Kernel Security Vulnerabilities

The Linux kernel versions from 5.9 to 7.3-rc1 have a security vulnerability. This vulnerability stems from improper handling of overlapping memory ranges by the mergememoryranges function. As a result, memory truncation occurs, and valid memory segments are lost from the kexec exclusion list. Thi...

PT-2026-93757

Name of the Vulnerable Software and Affected Versions Avast sandbox driver aswSnx.sys affected versions not specified Description Improper preservation of permissions in the aswSnx.sys minifilter driver on Windows allows a local, low-privileged attacker operating within the sandbox to escape file...

PT-2026-94021

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used...

PT-2026-93688

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/xe component where the get flat ccs offset function incorrectly rounds up the base of the flat CCS Compression Cache Storage storage to 128K. This rounding...

PT-2026-93968

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description Insufficient validation of user-supplied input allows an authenticated remote attacker with valid administrative credentials to obtain write access to the underlying operating system. This ...

PT-2026-93492

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the qla2x00 dfs fce write function within the scsi qla2xxx driver. The function calls kstrtoul using a NULL result pointer, which leads to a NULL pointer dereference a...

CVE-2026-84408: Exposed IOCTL with Insufficient Access Control

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to execute arbitrary commands with SYSTEM privileges...