CVE-2026-58086

CVE-2026-58086 is tied to FreeBSD ktrace: a privilege validation issue in jails allowed an unprivileged in-jail user to modify jailed root’s ktrace flags or disable tracing. Impact: jailed root users could not reliably trace unprivileged processes. The advisory fixes this by correcting privilege ...

CVE-2025-69943

The CVE-2025-69943 entry concerns the Hospital Management System 4.0. A SQL Injection vulnerability exists in get_doctor.php, exploitable via the parameters doctor and specilizationid. Affected software/components are specified only as the Hospital Management System 4.0; the vulnerability type is...

CVE-2025-67403

CVE-2025-67403 affects Sourcecodester CASAP Automated Enrollment System 1.0. The connected documents clearly state a SQL Injection in update_class.php via the parameter class_name (root cause is unparameterized input leading to injection). The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C...

CVE-2026-18264

NoMachine’s PT-2026-65932 describes a getstat command injection that enables remote code execution. The document identifies the vulnerability class as a Command Injection leading to RCE, affecting NoMachine, but provides no specific affected versions or remediation details. No exploitation detail...

CVE-2025-65340

CVE-2025-65340 affects Kishan0725 Hospital Management System 4.0: a SQL injection vulnerability in /betweendates-detailsreports.php. The CVSS v3.1 base score is 9.8 (CRITICAL) with high impact on confidentiality, integrity, and availability. Connected sources confirm the vulnerability but do not ...

CVE-2026-16637

OPeNDAP Hyrax is vulnerable to Server-Side Request Forgery (SSRF) and credential disclosure via unvalidated HTTP redirects that bypass the allowed-hosts allowlist. When a redirect is followed, the system may transmit user-related headers (including Echo-Token) to attacker-controlled endpoints, po...

CVE-2025-67404

CVE-2025-67404 affects Sourcecodester CASAP Automated Enrollment System 1.0. The flaw is SQL Injection in save_stud.php through fname, lname, and student_class, enabling likely total impact on confidentiality, integrity, and availability (CVSS v3.1 base score 9.8). Exploitation is possible (poc n...

CVE-2026-18303

CVE-2026-18303 is a reserved placeholder with no public details in the initial document. The connected PT-2026-65960 entry identifies a GIMP TIF file parsing stack-based buffer overflow leading to remote code execution, indicating an exploitable vulnerability in GIMP's TIFF handling. Details on a...

CVE-2025-67406

CVE-2025-67406 concerns an SQL Injection in Advocate office management system 1.0. The vulnerability resides in activate_case.php (parameter id, accessed via GET http://localhost/advocate/kortex_lite/control/activate_case.php?id=1) where unsanitized user input is interpolated into an SQL query. D...

CVE-2026-50782

CVE-2026-50782 describes an XML External Entity (XXE) injection in Jinher OA C6. The vulnerability is located at the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint, where an unauthenticated attacker can submit a crafted XML payload to read arbitrary files from the se...

CVE-2026-18309

The connected PT-2026-65966 entry identifies a concrete vulnerability affecting GIMP related to APNG file parsing: an integer overflow that leads to Remote Code Execution. Affected component is the APNG parsing path in GIMP; root cause is integer overflow during APNG data handling. The CVE-2026-1...

CVE-2026-51992

CVE-2026-51992 affects ClickHouse Server versions

CVE-2026-18278

PT-2026-65942 details a vulnerability in Sony XAV-9500ES vehicles infotainment hardware: an out-of-bounds read during an L2 decode of a packet (PRH L2). This information disclosure vulnerability is described in connected PT Security documentation; no exploit specifics, affected version ranges, or...

CVE-2026-18299

The connected PT Security entry PT-2026-65956 documents a Use-After-Free Remote Code Execution vulnerability in GStreamer’s rtpsbcdepay element. Affected component: GStreamer rtpsbcdepay. Outcome: remote code execution via use-after-free condition. No additional exploit specifics or versions are ...

CVE-2026-58045

CVE-2026-58045 is reported in the Node.js blog as: a flaw in the node:zlib sync APIs where a spoofed TypedArray byteLength can trigger a reachable assertion, potentially causing a crash and denial of service. Affected release lines include all active Node.js lines: 26.x, 24.x, 22.x . Remediation ...

CVE-2025-71386

Connected document PT-2026-65929 describes a TrendAI Vision One Service Gateway Logs Information Disclosure Vulnerability. The entry indicates an information disclosure issue affecting the Gateway’s log handling, but the provided materials do not specify affected versions, root cause, attack vect...

CVE-2026-58042

The connected Node.js July 2026 security releases document details CVE-2026-58042: a vulnerability in dns.resolveAny() that can abort when DNS responses include more than 256 A records, potentially causing denial of service. Affected release lines are 26.x, 24.x, and 22.x. The advisory indicates ...

CVE-2026-58085

The FreeBSD advisory FreeBSD-SA-26:52.if_wg discloses CVE-2026-58085: wg(4) failed to verify the Poly1305 MAC after decrypt, allowing remote attackers who can send UDP packets to a WireGuard endpoint (within the replay window) to inject or modify transport data. Affected: all supported FreeBSD ve...

CVE-2026-18260

Technical details for CVE-2026-18260 are not publicly available in the provided documents. The connected records reference unrelated Drupal contrib issues and indicate security concerns without specifics or fixes. Monitor for updates.

CVE-2026-58088

CVE-2026-58088 maps to a race condition in FreeBSD’s ELF core-dump handling. The kernel’s two-pass approach for counting dumpable VM map entries can be corrupted when a process shares an address space with a dumping process, allowing an unprivileged local user to cause an out-of-bounds heap write...

CVE-2026-18267

PT-2026-65934 documents a firmware-update link-following code execution vulnerability in the Kenwood DNR1007XR. The snippet does not provide explicit root-cause, affected software versions, exploit details, or remediation. No fixes are listed; monitor for vendor/PT Security updates.

CVE-2025-69944

The CVE-2025-69944 entry affects kishan0725 Hospital Management System 4.0. The vulnerability is a SQL Injection in the view-medhistory.php endpoint, exploitable through the viewid parameter. The connected documents confirm the existence of this vulnerability but do not provide explicit impact de...

CVE-2026-18269

CVE-2026-18269 entry is linked to a PT Security advisory PT-2026-65936 describing a bytestream read vulnerability in Kenwood DNR1007XR that results in an out-of-bounds write and code execution. The connected document provides the affected product and vulnerability type but does not specify versio...

CVE-2026-18273

Technical details for CVE-2026-18273 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-18274

PT-2026-65941 details a vulnerability affecting Heimdall Data Database Proxy, described as a Directory Traversal leading to Remote Code Execution via uploadJar. The CVE-2026-18274 entry is reserved with no public details, while the connected document provides concrete technical details about the ...

CVE-2025-65337

CVE-2025-65337 affects Sourcecodester’s Fantastic Blog CMS 1.0 . The vulnerability is a Cross Site Scripting (XSS) flaw in the file pageEditMember.php triggered via the address field. The documented impact is user-facing XSS; no exploitation details or confirmed mitigations are provided in the su...

CVE-2026-18261

Technical details for CVE-2026-18261 are not publicly provided in the supplied documents. Monitor for updates from relevant advisories or vendors.

CVE-2025-69945

The vulnerability is CVE-2025-69945 affecting Kishan0725 Hospital Management System 4.0, with a SQL Injection flaw in the web endpoint /doctor/edit-patient.php?editid=1. According to the provided data, the CVSS v3.1 base score is 7.3 (HIGH) with Network attack vector, Low confidentiality/integrit...

CVE-2025-71387

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-58041

In Node.js, CVE-2026-58041 affects the node:sqlite SQLTagStore path. A stale StatementSyncIterator created via DatabaseSync#createTagStore() can continue to execute a cached prepared statement after it has been reset and rebound with new parameters. The reset uses sqlite3_reset() directly, bypass...

CVE-2026-18282

Connected document PT-2026-65946 details a heap-based buffer overflow in Sony XAV-9500ES AVRCP Br Response Parser that leads to remote code execution. Affected component: AVRCP Br Response Parser in the Sony XAV-9500ES system. Root cause: heap-based overflow. Impact: remote code execution possibl...

CVE-2026-18307

Summary (Mode C): The connected PT-2026-65964 entry describes a vulnerability in GIMP related to TIF file parsing that causes a heap-based buffer overflow and leads to remote code execution. The documentation does not specify affected GIMP versions, exact vulnerable component/function, or exploit...

CVE-2026-18302

Concrete detail found: PT-2026-65959 describes a vulnerability in GIMP (GNU Image Manipulation Program) affecting the TIF file parsing path, specifically a heap-based buffer overflow that enables remote code execution. The issue stems from heap corruption during TIF parsing, allowing an attacker ...

CVE-2026-18305

PT-2026-65962 describes a remote code execution vulnerability in GIMP tied to TIFF file parsing, caused by an integer overflow. The issue affects the TIFF parsing path and can lead to RCE. The connected document does not provide explicit exploit details, affected versions, or remediation steps. M...

CVE-2026-18270

PT-2026-65937 documents a Local Privilege Escalation in Kenwood DNR1007XR udhcpd caused by Incorrect Permission Assignment. Affected component is udhcpd; impact is elevated privileges on the device. The PT entry cites Pwn2Own as the context. No remediation or patch details are provided in the con...

CVE-2026-18268

The connected PT security entry PT-2026-65935 describes a local privilege escalation via command injection in Kenwood DNR1007XR JKGenService. This CVE (CVE-2026-18268) is currently reserved in the Initial document; the connected entry provides concrete details about the affected product, componen...

CVE-2026-18297

CVEs in Connected Docs : PT-2026-65954 describes a stack-based buffer overflow in GStreamer’s OGG file parsing that causes remote code execution. The vulnerability arises during OGG file parsing; impact is remote code execution. The provided documents do not specify affected versions, exploitatio...

CVE-2026-58084

CVE-2026-58084 is addressed by the FreeBSD security advisory FreeBSD-SA-26:51.ktimer. The issue affects FreeBSD 15.0 and 15.1 (stable/15, 15.1-STABLE, releng/15.1 and 15.0 releases). A local unprivileged attacker can disclose uninitialized kernel stack memory by creating a POSIX timer with CLOCK_...

CVE-2026-18283

PTSecurity PT-2026-65947 documents a vulnerability affecting Sony XAV-9500ES involving a udev USB rules authorization bypass. The root cause is described as an authorization bypass in the udev USB rules functionality, enabling bypass of USB rules authorization. The available details do not specif...

CVE-2026-58044

CVE-2026-58044 is addressed in the July 2026 Node.js security releases. The issue is described as HTTP parser header truncation can enable request smuggling in Node.js HTTP client, potentially misframing requests. The release notes list the affected release lines (26.x, 24.x, 22.x) and provide fi...

CVE-2025-67405

CVE-2025-67405 affects Sourcecodester CASAP Automated Enrollment System 1.0. The vulnerability is a SQL Injection in update_password.php via the parameter new_password . This is the root cause, allowing unintended database queries. Documented impact shows low confidentiality, integrity, and avail...

CVE-2026-18301

The connected PT document PT-2026-65958 documents a concrete vulnerability: GIMP PSD File Parsing Integer Overflow Remote Code Execution. The issue concerns the PSD file parser component in GIMP, where an integer overflow during PSD parsing can lead to arbitrary code execution on affected systems...

CVE-2026-18265

PT-2026-65933 documents a Missing Authentication Remote Code Execution vulnerability in OSNEXUS QuantaStor. The provided snippet does not include product version, affected components, root cause, exploit details, or remediation steps, and there is no explicit CVE mapping to CVE-2026-18265 in the ...

CVE-2026-18284

The connected PT Security entry PT-2026-65948 documents a Sony XAV-9500ES vulnerability in the Crash Dump Handler that enables Command Injection leading to Local Privilege Escalation. Impact: local escalation via crafted input to the Crash Dump Handler. The CVE entry CVE-2026-18284 remains with r...

CVE-2026-18259

Summary: The Token Content Access module for Drupal allows content access via tokens. A timing-attack vulnerability exists because token comparison is not consistently protected, enabling a persistent attacker to potentially guess a valid access token and bypass content-restrictions. Mitigation i...

CVE-2026-18281

The connected PTSecurity entry PT-2026-65945 reports a heap-based buffer overflow in the L2 reassembly SDU path of Sony XAV-9500ES, enabling remote code execution. Affected component: L2 reassemble sdu. Impact is remote code execution as described. No vendor/version details or remediation are pro...

CVE-2025-60931

Summary: CVE-2025-60931 affects Infor Global HR v11.24.10.01.33 and is an Insecure Direct Object Reference (IDOR) in the Employee Compensation View function. An unauthorized attacker can view other employees’ compensation information via a crafted GET request. This vulnerability is categorized wi...

CVE-2026-18272

Technical details for CVE-2026-18272 are not publicly available in the provided documents. Monitor for updates.

CVE-2025-67408

CVE-2025-67408 affects Sourcecodester CASAP Automated Enrollment System 1.0. The vulnerability is an SQL Injection in /save_user.php via the parameter status. Documented impact is partial confidentiality, integrity, and availability impact with a CVSS 3.1 base score of 7.3 (HIGH), attack vector N...

CVE-2026-18295

The connected PT-2026-65952 entry identifies a vulnerability in GStreamer MRF file parsing causing an out-of-bounds write and remote code execution. The impact is stated as Remote Code Execution, triggered via parsing of MRF files; no affected product versions, detailed root cause, or exploit spe...