Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities in system and open source components

Summary IBM Integrated Analytics System IIAS includes various open source packages, runtimes, and system libraries as part of its underlying platform. Multiple security vulnerabilities have been identified across components including Oracle Java SE, cryptography, Apache HttpComponents, libssh,...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) CallHome component is affected by multiple vulnerabilities

Summary The CallHome component in IBM Cloud Pak for Data System 1.0 includes several open-source and third-party frameworks and packages as part of its management and diagnostic infrastructure. Multiple security vulnerabilities have been identified in underlying components, including Django, Go...

CVE-2026-36213-poc

CVE-2026-36213: MEmu Android Emulator 9.2.7.0 Local Privilege Escalation https://img.shields.io/badge/platform-Windows-blue https://img.shields.io/badge/CVE-2026--36213-red https://img.shields.io/badge/EDB--ID-52615-orange Overview This repository contains a Python proof-of-concept PoC for...

CVE-2026-21120

Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege...

CVE-2026-21120

A Use after free vulnerability exists in the WSM service on devices running software prior to SMR Oct-2026 Release 1 . This flaw allows local attackers to potentially achieve arbitrary code execution with system privilege . While the NCSC notes broader Android vulnerabilities, this specific CVE i...

CVE-2026-21120

Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege...

EUVD-2026-97184

Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege...

CVE-2026-108795

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

CVE-2026-108795 ZKTeco BioTime System Settings API systemSettings access control

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

CVE-2026-108795 ZKTeco BioTime System Settings API systemSettings access control

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

EUVD-2026-97166

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

CVE-2026-108795

A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 within the System Settings API component. Specifically, an unknown functionality in the file /base/api/systemSettings suffers from improper access controls (CWE-284, CWE-266). An attacker can initiate this attack remotely to manip...

CVE-2026-87765 Improper Input Validation in Kernel APsys DVFS

In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges...

EUVD-2026-97140

In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges...

Pizzafy 1.0 Shell Upload / SQL Injection

Pizzafy version 1.0 suffers from remote shell upload and remote SQL injection vulnerabilities. Title: pizzafy-1.0-Multiple-SQLi&FU-shell-vulnerabiliries+Exploit Author: nu11secur1ty Date: 10/12/2026 Vendor: https://github.com/clararod9 Software:...

CVE-2026-109305: Improper Neutralization of Special Elements Used in a Template Engine

Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators. Users with the System Messages permission can supply two-argument callables such as passthru or system in sandboxed templates t...

CVE-2026-108927: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulation of the argument bid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made availab...

CVE-2026-108937: Insertion of Sensitive Information into Externally-Accessible File or Directory

A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql. The manipulation results in file and directory information exposure. It is possible to launch the attack remotely. The exploit is now...

CVE-2024-58390: Improper Privilege Management

Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with...

CVE-2026-108938: Files or Directories Accessible to External Parties

A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been published and may be used...