CVE-2026-58084

CVE-2026-58084 is addressed by the FreeBSD security advisory FreeBSD-SA-26:51.ktimer. The issue affects FreeBSD 15.0 and 15.1 (stable/15, 15.1-STABLE, releng/15.1 and 15.0 releases). A local unprivileged attacker can disclose uninitialized kernel stack memory by creating a POSIX timer with CLOCK_...

CVE-2026-18282

Connected document PT-2026-65946 details a heap-based buffer overflow in Sony XAV-9500ES AVRCP Br Response Parser that leads to remote code execution. Affected component: AVRCP Br Response Parser in the Sony XAV-9500ES system. Root cause: heap-based overflow. Impact: remote code execution possibl...

CVE-2026-18267

PT-2026-65934 documents a firmware-update link-following code execution vulnerability in the Kenwood DNR1007XR. The snippet does not provide explicit root-cause, affected software versions, exploit details, or remediation. No fixes are listed; monitor for vendor/PT Security updates.

CVE-2026-18274

PT-2026-65941 details a vulnerability affecting Heimdall Data Database Proxy, described as a Directory Traversal leading to Remote Code Execution via uploadJar. The CVE-2026-18274 entry is reserved with no public details, while the connected document provides concrete technical details about the ...

CVE-2025-65337

CVE-2025-65337 affects Sourcecodester’s Fantastic Blog CMS 1.0 . The vulnerability is a Cross Site Scripting (XSS) flaw in the file pageEditMember.php triggered via the address field. The documented impact is user-facing XSS; no exploitation details or confirmed mitigations are provided in the su...

CVE-2026-18307

Summary (Mode C): The connected PT-2026-65964 entry describes a vulnerability in GIMP related to TIF file parsing that causes a heap-based buffer overflow and leads to remote code execution. The documentation does not specify affected GIMP versions, exact vulnerable component/function, or exploit...

CVE-2026-18302

Concrete detail found: PT-2026-65959 describes a vulnerability in GIMP (GNU Image Manipulation Program) affecting the TIF file parsing path, specifically a heap-based buffer overflow that enables remote code execution. The issue stems from heap corruption during TIF parsing, allowing an attacker ...

CVE-2026-18260

Technical details for CVE-2026-18260 are not publicly available in the provided documents. The connected records reference unrelated Drupal contrib issues and indicate security concerns without specifics or fixes. Monitor for updates.

CVE-2026-18269

CVE-2026-18269 entry is linked to a PT Security advisory PT-2026-65936 describing a bytestream read vulnerability in Kenwood DNR1007XR that results in an out-of-bounds write and code execution. The connected document provides the affected product and vulnerability type but does not specify versio...

CVE-2025-71387

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2025-69945

The vulnerability is CVE-2025-69945 affecting Kishan0725 Hospital Management System 4.0, with a SQL Injection flaw in the web endpoint /doctor/edit-patient.php?editid=1. According to the provided data, the CVSS v3.1 base score is 7.3 (HIGH) with Network attack vector, Low confidentiality/integrit...

CVE-2026-58088

CVE-2026-58088 maps to a race condition in FreeBSD’s ELF core-dump handling. The kernel’s two-pass approach for counting dumpable VM map entries can be corrupted when a process shares an address space with a dumping process, allowing an unprivileged local user to cause an out-of-bounds heap write...

CVE-2026-18261

Technical details for CVE-2026-18261 are not publicly provided in the supplied documents. Monitor for updates from relevant advisories or vendors.

CVE-2026-18283

PTSecurity PT-2026-65947 documents a vulnerability affecting Sony XAV-9500ES involving a udev USB rules authorization bypass. The root cause is described as an authorization bypass in the udev USB rules functionality, enabling bypass of USB rules authorization. The available details do not specif...

CVE-2026-18268

The connected PT security entry PT-2026-65935 describes a local privilege escalation via command injection in Kenwood DNR1007XR JKGenService. This CVE (CVE-2026-18268) is currently reserved in the Initial document; the connected entry provides concrete details about the affected product, componen...

CVE-2025-69944

CVE-2025-69944 affects Kishan0725 Hospital Management System 4.0. The vulnerability is a SQL injection in view-medhistory.php via the viewid parameter. The CVSS 3.1 base score is 7.3 (HIGH) with Network attack vector, low complexity, no privileges, and no user interaction required. Connected sour...

CVE-2026-18305

PT-2026-65962 describes a remote code execution vulnerability in GIMP tied to TIFF file parsing, caused by an integer overflow. The issue affects the TIFF parsing path and can lead to RCE. The connected document does not provide explicit exploit details, affected versions, or remediation steps. M...

CVE-2025-67405

CVE-2025-67405 affects Sourcecodester CASAP Automated Enrollment System 1.0. The vulnerability is a SQL Injection in update_password.php via the parameter new_password . This is the root cause, allowing unintended database queries. Documented impact shows low confidentiality, integrity, and avail...

CVE-2026-18295

The connected PT-2026-65952 entry identifies a vulnerability in GStreamer MRF file parsing causing an out-of-bounds write and remote code execution. The impact is stated as Remote Code Execution, triggered via parsing of MRF files; no affected product versions, detailed root cause, or exploit spe...

CVE-2026-18265

PT-2026-65933 documents a Missing Authentication Remote Code Execution vulnerability in OSNEXUS QuantaStor. The provided snippet does not include product version, affected components, root cause, exploit details, or remediation steps, and there is no explicit CVE mapping to CVE-2026-18265 in the ...

CVE-2026-18301

The connected PT document PT-2026-65958 documents a concrete vulnerability: GIMP PSD File Parsing Integer Overflow Remote Code Execution. The issue concerns the PSD file parser component in GIMP, where an integer overflow during PSD parsing can lead to arbitrary code execution on affected systems...

CVE-2026-18279

PTSecurity PT-2026-65943 documents a concrete vulnerability: Sony XAV-9500ES RTSP SETUP buffer overflow leading to Remote Code Execution. Details specify the affected device and the vulnerability class, but do not provide exploit code or remediation steps. Exploit status and exact fix/version are...

CVE-2025-67407

CVE-2025-67407 affects Sourcecodester CASAP Automated Enrollment System 1.0. The connected documents confirm a SQL Injection vulnerability in update_student.php triggered via the parameters fname and student_class . The CVSS 3.1 base metrics indicate a HIGH severity (7.3) with network attack vect...

CVE-2025-69949

CVE-2025-69949 affects Kishan0725 Hospital Management System 4.0. The vulnerability is a SQL Injection in check_availability.php exploitable via the parameters emailid and email. The CVSS 3.1 base score is 7.3 (High) with network attack vector, low attack complexity, no privileges required, and n...

CVE-2026-18280

PT Security PT-2026-65944 documents a gpsd buffer overflow in Sony XAV-9500ES devices that leads to arbitrary code execution. The CVE-2026-18280 entry is reserved here and public details are not provided within the initial document. No remediation details are supplied in the connected documents.

CVE-2026-15686

The connected PT-2026-65931 entry describes an Adminer vulnerability where remote code execution occurs due to an incorrect check of the return value from multi-query execution. The provided documents do not specify affected versions, patch details, or mitigations. Further details on scope and fi...

CVE-2026-18281

The connected PTSecurity entry PT-2026-65945 reports a heap-based buffer overflow in the L2 reassembly SDU path of Sony XAV-9500ES, enabling remote code execution. Affected component: L2 reassemble sdu. Impact is remote code execution as described. No vendor/version details or remediation are pro...

CVE-2026-18286

Technical details for CVE-2026-18286 are not publicly available in the provided documents. Monitor for updates; no explicit affected products, root cause, impact, or fixes are described here.

CVE-2026-18271

Technical details for CVE-2026-18271 are not publicly available in the provided documents. Monitor for updates and new disclosures as information may be released later.

CVE-2026-18298

PT-2026-65955 references CVE-2026-18298 and describes a GStreamer PNG file parsing heap-based buffer overflow that enables remote code execution. The connected document provides the vulnerability type and impact but does not specify affected GStreamer versions, root cause details beyond heap-base...

CVE-2026-18300

CVE-2026-18300 appears to be a reserved entry, but a connected vulnerability entry PT-2026-65957 describes a concrete issue: GIMP HDR file parsing contains an integer overflow that enables remote code execution. The affected component is GIMP’s HDR image parsing logic; root cause is an integer ov...

CVE-2026-18272

Technical details for CVE-2026-18272 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-18284

The connected PT Security entry PT-2026-65948 documents a Sony XAV-9500ES vulnerability in the Crash Dump Handler that enables Command Injection leading to Local Privilege Escalation. Impact: local escalation via crafted input to the Crash Dump Handler. The CVE entry CVE-2026-18284 remains with r...

CVE-2026-58087

CVE-2026-58087 is detailed in the FreeBSD advisory FREEBSD-SA-26:54.sysvsem. It describes a heap out-of-bounds access in the kernel’s semctl(2) handling for System V semaphores, affecting all supported FreeBSD versions. The vulnerability arises when GETALL/SETALL read/write operations drop the lo...

CVE-2026-62660

The connected PTSecurity entry PT-2026-65967 documents a vulnerability described as “Trend AI Cleaner One Pro Link Following Arbitrary File Deletion Vulnerability.” The information provided is limited: it identifies the vulnerability class (arbitrary file deletion) and the affected product name (...

CVE-2025-69942

CVE-2025-69942 affects kishan0725 Hospital Management System 4.0 and is described as a SQL Injection vulnerability in the endpoint /hms/doctor/view-patient.php?viewid=1. The connected sources provide explicit vulnerability details (SQLi in the listed path) and a CVSS 3.1 vector with base score 9....

CVE-2025-67408

CVE-2025-67408 affects Sourcecodester CASAP Automated Enrollment System 1.0. The vulnerability is an SQL Injection in /save_user.php via the parameter status. Documented impact is partial confidentiality, integrity, and availability impact with a CVSS 3.1 base score of 7.3 (HIGH), attack vector N...

CVE-2026-18306

Summary: PT-2026-65963 describes a remote code execution vulnerability in the GIMP SGI file parser caused by an integer overflow. The issue is triggered during SGI file parsing and could allow arbitrary code execution on affected systems. The Connected document confirms the vulnerability class an...

CVE-2026-18259

Summary: The Token Content Access module for Drupal allows content access via tokens. A timing-attack vulnerability exists because token comparison is not consistently protected, enabling a persistent attacker to potentially guess a valid access token and bypass content-restrictions. Mitigation i...

CVE-2026-18308

GIMP is reported to have a TIFF file parsing integer overflow leading to Remote Code Execution (RCE) per PT-2026-65965. The vulnerability involves TIFF image parsing and does not include CVE-specific version mappings, exploit details, or patch information in the provided documents. The connected ...

CVE-2026-18285

CVE-2026-18285 is reserved with no public details in the initial description. The connected PT-2026-65949 entry documents a Remote Code Execution vulnerability described as deserialization of untrusted data. No affected product/version, exploit status, or remediation information is provided in th...

CVE-2025-60931

Summary: CVE-2025-60931 affects Infor Global HR v11.24.10.01.33 and is an Insecure Direct Object Reference (IDOR) in the Employee Compensation View function. An unauthorized attacker can view other employees’ compensation information via a crafted GET request. This vulnerability is categorized wi...

CVE-2026-18287

Technical details for CVE-2026-18287 are not publicly available in the provided documents. The connected PT Security entry mentions a Code Injection / Remote Code Execution vulnerability but does not specify affected products, versions, impact, or fixes. Monitor for updates.

CVE-2026-18296

CVE-2026-18296 is linked to PT-2026-65953, which documents a GStreamer MRF File Parsing heap-based buffer overflow that allows remote code execution . The connected document provides the vulnerability type and impact but does not specify affected versions, patches, or exploitation details. No add...

CVE-2026-56822

CVE-2026-56822 affects Netty’s OcspServerCertificateValidator. The TOCTOU race forwards SslHandshakeCompletionEvent before OCSP validation finishes, potentially allowing downstream handlers to send data to a revoked server before the OCSP check closes the channel. Affected releases: prior to 4.1....

CVE-2026-56821

CVE-2026-56821 (Netty) affects Netty’s OcspServerCertificateValidator. Prior to 4.1.136.Final and 4.2.16.Final, it flags an out-of-date OCSP response but does not stop processing, causing an expired GOOD response to be treated as VALID. This can allow an on-path attacker to replay a stale GOOD OC...

CVE-2026-49446

Technical details for CVE-2026-49446 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-59921

CVE-2026-59921 affects Netty’s HttpPostRequestEncoder. Before 4.1.136.Final and 4.2.16.Final, multipart HTTP request bodies were built by directly concatenating user-supplied filenames/field names into Content-Disposition headers without validating CRLF. This allows an attacker-controlled filenam...

CVE-2026-54659

Pagy (Ruby gem) contains a vulnerability in the I18n locale handling prior to 43.5.6: Pagy::I18n.locale= stores locale values verbatim and later uses them as .yml path components, enabling untrusted params[:locale] values with absolute paths or ../ sequences to probe file existence/readability of...

CVE-2026-54650

CVE-2026-54650 describes a path traversal vulnerability in openhole-server prior to 0.1.2. In 0.1.1 and earlier, internal/server/public_proxy.go forwarded the request using r.URL.Path instead of preserving the original target via r.URL.EscapedPath(). This allowed percent-encoded dot segments (%2e...