CVE-2026-105387

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql...

CVE-2026-105643 Ghost: Stored XSS via Embed Card Previews

Ghost is a Node.js content management system. From version 6.34.0 until 6.67.0, embed cards in the Ghost editor could bypass protections against stored cross-site scripting. Any staff user, including Contributors, could store scripts in post content that ran when another staff user opened the pos...

CVE-2026-105387 girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injection

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql...

CVE-2026-105387

A security flaw exists in the girishsaraf Online-Appointment-Booking-System (up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5) within the Patient Login Handler component. The vulnerability is located in the mysqli_query function of the cover.php file. By manipulating the uname/psw arguments,...

CVE-2026-105387 girishsaraf Online-Appointment-Booking-System Patient Login cover.php mysqli_query sql injection

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql...

EUVD-2026-92631

A security flaw has been discovered in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqliquery of the file cover.php of the component Patient Login Handler. The manipulation of the argument uname/psw results in sql...

CVE-2026-49878

In wpashandlerobustavscsrecvaction of robustav.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-92600

In wpashandlerobustavscsrecvaction of robustav.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49878

A logic error in the wpas_handle_robust_av_scs_recv_action function within robust_av.c results in a possible out-of-bounds write . This vulnerability could potentially lead to remote code execution requiring System execution privileges . Exploitation does not require user interaction. No specific...

CVE-2026-49878

In wpashandlerobustavscsrecvaction of robustav.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation...

MAL-2026-17624 Malicious code in documenclient (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffd20318a8d48dc20fee95097373ebd1039481031985164a651d2b68d366565a [email protected] publishes an npm package whose only shipped content is a heavily obfuscated PowerShell script embedded in the README. The script...

CVE-2026-90364

A flaw was found in the Linux kernel's ACPI Advanced Configuration and Power Interface processor initialization. During the setup process, if certain driver registration or CPU hotplug state configurations fail, a cpufreq notifier may remain improperly registered. This improper resource cleanup c...

CVE-2026-37719

An issue in dormakaba evolo Service all versions allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component...

Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by a cross-site request forgery vulnerability (CVE-2026-8408)

Summary A security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager CVE-2026-8408 Vulnerability Details CVEID:CVE-2026-8408 DESCRIPTION: IBM WebSphere Application Server is affected by a cross-site request forgery,...

USN-8871-1: Linux kernel (Raspberry Pi) vulnerabilities

It was discovered that some Arm processors could complete a broadcast translation lookaside buffer TLB invalidation before memory writes made through the invalidated translation were globally observed. A local attacker could possibly use this to write to memory after permission to do so had been...

USN-8851-3: Linux kernel (Azure) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system NFS server daemon; - IPv6 networking; - Netfilter; CVE-2025-38724, CVE-2026-53131, CVE-2026-532...

Windows Print Spooler RCE (PrintNightmare CVE-2021-34527)

Exploits CVE-2021-34527 PrintNightmare: abuses MS-RPRN RpcAddPrinterDriverEx to register a remote printer driver pointing at an attacker-controlled UNC DLL, executing code as SYSTEM when the Print Spooler service processes the install. !/usr/bin/env python3 -- coding: utf-8 -- """Windows Print...

Ruby on Rails YAML Deserialization RCE (CVE-2013-0156)

Exploits CVE-2013-0156 in Rails 3.x: XML requests with type=yaml deserialize attacker-controlled YAML into Ruby objects, reaching Kernelsystem via Gem gadgets. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails XML/YAML deserialization RCE CVE-2013-0156.""" from kittysploit import from...

kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

A flaw was found in the Linux kernel's netfilter component, specifically within the nfqueue functionality. When a bridged packet is queued to NFQUEUE, it can retain a reference to a bridge's private fake destination 'dst' even after the bridge teardown has begun. This can lead to a use-after-free...

kernel: ipvs: clear the svc scheduler ptr early on edit

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. During the ipvseditservice operation, the svc-scheduler pointer is cleared too late when unbinding an old scheduler. This improper handling allows packets to access previously freed scheduler data, leading to a use-after-fre...