CVE-2026-7188 SQLi in Armiya Information Technologies' Access Control System

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...

CVE-2026-7188

Armiya Information Technologies Ltd. Co. Access Control System versions before Version 2 are affected by an SQL injection vulnerability caused by improper neutralization of special elements used in an SQL command. The vulnerability is rated CRITICAL (CVSS 9.8) with a network attack vector, low co...

EUVD-2026-75293

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...

CVE-2026-84939

Apache FreeMarker versions 2.2.0 through 2.3.34 are vulnerable to a path traversal vulnerability in the template loading mechanism. This flaw occurs when an attacker provides a specially crafted, malformed locale identifier while the localized lookup configuration setting is enabled (which is the...

CVE-2026-87933

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtilsMergePatch of the file cJSONUtils.c. The manipulation results in use after free. The attack may be launched remotely. The exploit has been made public and could be used. The pull request to...

PT-2026-89369

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in GIS Informatics GisLab Laboratory Management System allows Path Traversal. This issue affects GisLab Laboratory Management System: from 1.4.03 before 1.5...

PT-2026-89371

Name of the Vulnerable Software and Affected Versions Capgo affected versions not specified Description Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, which leaves stale overrides active. This allows attackers to retain channel-specif...

PT-2026-89439

Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions...

CVE-2026-38626

Garlic-Hub v1.0.1 is vulnerable to SQL Injection due to the improper neutralization of special elements used in an SQL command. The flaw is located within the src/Modules/Items/Repositories/ItemsRepository.php file. This vulnerability allows for unauthorized access to or manipulation of the under...

PT-2026-89465

Name of the Vulnerable Software and Affected Versions Dell ThinOS 10 versions prior to 2605 10.2616 Description An issue exists where the Security Version Number is mutable to older versions. A low privileged attacker with physical access to the device could exploit this to bypass protection...

PT-2026-89429

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

OPENSUSE-SU-2026:11748-1 python315-3.15.0~rc2-1.1 on GA media

These are all security issues fixed in the python315-3.15.0rc2-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-89437

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

PT-2026-89443

Unauthenticated SQL Injection in Verified Reviews Avis Vérifiés = 2.4.6 versions...

PT-2026-89432

Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...

PT-2026-89447

Unauthenticated Privilege Escalation in SiteSkite = 2.1.5 versions...

PT-2026-89445

Subscriber Remote Code Execution RCE in RepairBuddy = 4.1224 versions...

PT-2026-89430

Subscriber Broken Authentication in MailMunch – Grow your Email List = 3.2.5 versions...

PT-2026-89300

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Armiya Information Technologies Ltd. Co. Access Control System allows SQL Injection. This issue affects Access Control System: before Versiyon 2...

CVE-2026-88860: Incorrect Authorization

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OT...