CVE-2026-85529

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read internal notes and confidential system notes on public projects due to...

CVE-2026-108948

A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Profile Update Handler. The manipulation of the argument usertypeid leads to...

CVE-2026-108956

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

EUVD-2026-98235

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

CVE-2026-108956 code-projects Online Reviewer System User Update btn_functions.php sql injection

A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launch...

CVE-2026-108956

A SQL injection vulnerability exists in the code-projects Online Reviewer System 1.0 within the User Update Handler component. The flaw is located in an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php. This vulnerability can be exploited remotely to mani...

CVE-2026-89110

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise...

EUVD-2026-98231

A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Profile Update Handler. The manipulation of the argument usertypeid leads to...

CVE-2026-108948 code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes

A vulnerability has been found in code-projects Online Reviewer System 1.0. This vulnerability affects unknown code of the file /reviewer/system/system/admins/manage/users/btnfunctions.php of the component User Profile Update Handler. The manipulation of the argument usertypeid leads to...

CVE-2026-108948

The code-projects Online Reviewer System 1.0 is vulnerable to a flaw in the User Profile Update Handler component, specifically within the file /reviewer/system/system/admins/manage/users/btn_functions.php. An attacker can remotely initiate an attack by manipulating the usertype_id argument, whic...

EUVD-2026-98091

A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exploit has been published and may be used...

EUVD-2026-98082

A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql. The manipulation results in file and directory information exposure. It is possible to launch the attack remotely. The exploit is now...

EUVD-2024-55785

Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with...

EUVD-2026-98192

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise...

CVE-2026-89110

The SAP NetWeaver Visual Composer software is vulnerable to broken access control due to insufficient authorization checks within certain portal functionalities. An attacker with low privileges can exploit this flaw to invoke internal operations on a preconfigured remote system. Depending on the ...

CVE-2026-89110 Broken Access Control in SAP NetWeaver Visual Composer

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise...

CVE-2026-19936

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...

Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)

"The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8889-1 advisory. It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local...

Ubuntu 22.04 LTS : Linux kernel (Azure CVM) vulnerabilities (USN-8876-1)

"The remote Ubuntu 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8876-1 advisory. It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null...

CVE-2026-19936: Concurrent Execution using Shared Resource with Improper Synchronization

The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayablemsg.c shares three intrusive lists busyctx, freectx, freechunks and one kworkdelayable between two cooperative threads with no synchronization: btmeshdelayablemsgmanage runs on the Bluetooth host RX thread,...