PT-2026-92329

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A logic error in the code across multiple locations allows for a local escalation of privilege. This issue enables an attacker to gain System execution privileg...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37978)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from incorrect handling of the prodcode parameter in the file/pages/proedit1.php. Attackers...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37979)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the failure of the /pages/inv Edit1.php file to properly validate the ID parameter...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37980)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the failure of the /pages/sup Edit1.php file to properly validate the ID parameter...

School Registration and Fee System SQL Injection Vulnerability (CNVD-2026-37879)

School Registration and Fee System is a school registration and fee management software developed by the SourceCodester community. The system has a SQL injection vulnerability, which stems from incorrect handling of the period parameter in the file bilal/normal/payreport.php. Attackers can exploi...

CVE-2026-76707: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to view some system memory contents. Successful exploitation could allow an attacker to gain insight into internal services and workflows, increasing the risk of unauthorized access and...

CVE-2026-76678: Improper Privilege Management

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on th...

CVE-2026-76674: Buffer Copy without Checking Size of Input

Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to execute arbitrary code. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying...

CVE-2026-92180: Uncontrolled Search Path Element

pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of pdfforge PDF Architect. An attacker must first obtain the ability to...

CVE-2026-58765: Protection Mechanism Failure

In GPU, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56972: Out-of-bounds Write

In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0179: Improper Privilege Management

In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-90858: Authorization Bypass Through User-Controlled Key

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function sessionstart of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The...

CVE-2026-90845: Improper Neutralization of Input During Web Page Generation

A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been...

PT-2026-92673

Name of the Vulnerable Software and Affected Versions Oracle Application Testing Suite version 13.3.0.1 Description An unauthenticated attacker with access to the infrastructure where the software executes can compromise the system. This issue requires human interaction from a person other than t...

PT-2026-92796

Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0 Description A flaw in the Platform Security component allows a high privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead...

PT-2026-92369

In smmu install nested ste of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-91004: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /deletefaculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to th...

CVE-2026-92234: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the...

CVE-2026-91996: Missing Authentication for Critical Function

lamp-cloud through 5.10.0 whitelists the path pattern //anno/ for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath...