CVE-2026-109620

The SourceCodester Online Reviewer System 1.0 is vulnerable to a SQL injection flaw due to improper handling of arguments in the PDO::prepare function within the login/index.php file. An attacker can remotely manipulate the username or password arguments to execute arbitrary SQL commands. Public ...

EUVD-2026-98920

A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The explo...

CVE-2026-109525

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username/timestamp/status leads to...

CVE-2026-109605

A security vulnerability has been detected in SourceCodester Simple Cafe Billing System 1.0. This affects the function Action::saveuser of the file adminclass.php of the component User Management. The manipulation of the argument Type leads to improper authorization. The attack is possible to be...

CVE-2026-109524

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Display Pages. This manipulation causes missing authorizatio...

CVE-2026-104005

A security issue was discovered in MongoDB mongos the sharded cluster router where an authenticated user with readWrite privileges could crash the mongos process by crafting a specially formed aggregation pipeline. The issue leverages an internal aggregation stage that lacks proper authorization...

EUVD-2026-98851

A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. Th...

CVE-2026-109607 SourceCodester Online Exam System Login Endpoint loginExe.php sql injection

A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.php of the component Login Endpoint. This manipulation of the argument username/pass causes sql injection. It is possible to initiate the attack remotely. Th...

CVE-2026-109607

A SQL injection vulnerability exists in SourceCodester Online Exam System 1.0 within the Login Endpoint component. Specifically, an unknown function in the file adminpanel/admin/query/loginExe.php fails to properly neutralize inputs for the username/pass arguments. This flaw allows for remote att...

kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

A flaw was found in the Linux kernel's IPv4 networking component. The ipv4sysctlexitnet function prematurely frees the net-ipv4.sysctllocalreservedports memory. This can lead to a use-after-free vulnerability, where other threads might attempt to access deallocated memory. Such an issue can resul...

CVE-2026-106034

A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system...

CVE-2026-106034

A Path Traversal vulnerability exists in Ivanti Xtraction before version 2026.4 . This flaw allows a remote authenticated attacker to create or modify arbitrary directories on the host file system. The vulnerability is categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Di...

CVE-2026-106034

A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system...

EUVD-2026-98840

A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::saveuser of the file admin/adminclass.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote...

CVE-2026-109606 SourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection

A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::saveuser of the file admin/adminclass.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote...

CVE-2026-109606

The SourceCodester Art Gallery Management System 1.0 is vulnerable to a SQL injection flaw within the Account Creation component. Specifically, the Action::save_user function in the admin/admin_class.php file fails to properly neutralize the Name argument. This vulnerability allows for remote exp...

CVE-2026-109606 SourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection

A vulnerability was detected in SourceCodester Art Gallery Management System 1.0. This impacts the function Action::saveuser of the file admin/adminclass.php of the component Account Creation. The manipulation of the argument Name results in sql injection. The attack may be performed from remote...

Rakuten Mobile Rakuten Mini Trust Management Vulnerability

Rakuten Mobile and Rakuten Mini have vulnerabilities related to trust management. These vulnerabilities stem from the use of the Android Verified Boot AVB feature with AOSP test keys. Attackers could potentially install modified system images by physically accessing affected devices...

TR7 Cyber Defense TR7 ASP Command Injection Vulnerability

Versions of TR7 Cyber Defense TR7 ASP from 1.0.40.236 to 1.0.1554.2331 and from 1.6.42.239 to 1.6.1554.2331 have a command injection vulnerability. This vulnerability stems from improper handling of special elements used in operating system commands, which may lead to command injection attacks...

Yiyi Wang Crossnote Code Injection Vulnerability

Yiyi Wang’s Crossnote versions prior to 0.8.29 have a code injection vulnerability. This vulnerability stems from the use of vm.runInNewContext in the .crossnote/config.js and .crossnote/parser.js files, which lack a secure boundary with the Node.js host domain. Opening Markdown files from...