CVE-2026-16485

SourceCodester Class and Exam Timetabling System 1.0 suffers a cross-site scripting (XSS) vulnerability in /class.php via manipulation of the day parameter. The issue can be exploited remotely and the exploit has been disclosed publicly. No additional technical details (such as exact payloads, af...

CVE-2026-16485 SourceCodester Class and Exam Timetabling System class.php cross site scripting

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipulation of the argument day leads to cross site scripting. The attack can be launched remotely. The exploit has been...

CVE-2026-63926

A flaw was found in the Linux kernel's sockmap feature. When the bpfmsgpushdata function processes data, it incorrectly calculates the offset for data fragments, leading to an inconsistent memory arrangement. This issue could potentially allow a local attacker to cause data corruption or system...

CVE-2026-62549

Vulnerability in the Oracle HRMS UK product of Oracle E-Business Suite component: UK Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS UK. While the vulnerability...

CVE-2026-62546

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Web Utilities. Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Applications...

CVE-2026-60681

...

CVE-2026-60150

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

EUVD-2026-46418

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

EUVD-2026-46356

Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system...

EUVD-2026-46357

An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution...

CVE-2026-16484

SourceCodester Class and Exam Timetabling System 1.0 is affected by a SQL injection in the /edit_subjecta.php parameter ID. The vulnerability arises from manipulating the ID argument, enabling remote exploitation. The exploit has been published and may be used. CVSS metrics in the entry indicate ...

CVE-2026-8988

CVE-2026-8988 affects Autel Maxi Charger Single firmware up to V1.03.51. A UART interface exposed on the device allows interruption of the boot process and access to the U-Boot bootloader. With physical access, an attacker can modify boot configuration or file system to obtain operating system ac...

CVE-2026-8988 Access to Bootloader

Autel Maxi Charger Single firmware through V1.03.51 exposes an accessible UART interface that permits interruption of the boot process and access to the U-Boot bootloader. An attacker with physical access can modify the boot configuration or file system to obtain operating system access...

CVE-2026-44878

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

CVE-2026-63911

A flaw was found in the Linux kernel's xfrm: iptfs component. This vulnerability arises from incorrect handling of runtime data when cloning Security Associations SAs. If a state migration fails, the cloned state can improperly share memory with the original, leading to use-after-free and...

CVE-2026-8985

CVE-2026-8985 affects Autel Maxi Charger Single firmware up to version 1.03.51. The vulnerability is an OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can craft input in the URL parameter to execute arbitrary operating-system commands. The NVD ent...

MAL-2026-10979 Malicious code in @apexfdn/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...

CVE-2026-63092 kirby-modules License Key Disclosure via modules/activate Dialog

kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the modules/activate dialog endpoint. The plugin's activate dialo...

CVE-2026-63878

A flaw was found in the drm/amdgpu component of the Linux kernel. A local attacker can exploit an integer overflow vulnerability by providing an excessively large value for the numentries parameter in the GEMOP GETMAPPINGINFO ioctl. This can lead to an attempt to allocate an extremely large amoun...

CVE-2026-63869

A flaw was found in the Linux kernel's mac80211 WiFi subsystem. This vulnerability allows an attacker to cause undefined behavior by injecting a specially crafted frame with an invalid radiotap header. This can lead to system instability or a denial of service DoS, potentially causing the system ...