CVE-2026-112152

A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqliquery of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sq...

CVE-2026-112158

A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function samecheck of the file iptSAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address thi...

CVE-2026-111045

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

CVE-2026-111056

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted ema...

CVE-2026-111058

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

CVE-2026-111053

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...

CVE-2026-111046

FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and managesettings checks. A low-privileged staff account with...

CVE-2026-111057

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKEDPATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint...

CVE-2026-109431

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that...

CVE-2026-109433

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109432

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2026-107567

Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write signed with the DKIM key of a domain the server hosts, so that it passes DKIM and DMARC for that domain at other receivers. With...

CVE-2026-107081

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints admin/AJAXlookuphandler.php, admin/AJAXcheckid.php, admin/AJAXvocabolarycontrol.php in SENAYAN Library Management System SLiMS Bulian 9.8.0 allows any authenticated staff user to extrac...

CVE-2026-107566

Missing authorization in the Sieve editheader action 6.2.22 through 6.3.6 and in the mail-rule Set header value action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to make the server send mail as any address, DKIM-signed where the address is at a domain the...

CVE-2026-107569

Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop the server carrying mail. The server bounds the mail it generates in response to a message - a rule forward, reply or copy, an account forward, a Sieve...

CVE-2026-107568

Missing authorization in the Sieve notify action 6.2.22 through 6.3.6 and in the mail-rule Reply action 6.0.0 through 6.3.6 of Progressive Robot hMailServer allows an authenticated user to send mail through the server as any address. A Sieve notify sends a notification message, and its :from tag...

CVE-2026-107571

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user to run code as the mail server's high-privileged accounts when the product is installed in a folder whose permissions are inherited from a writable parent,...

CVE-2026-86375

Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-112328

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the addnewmoduleterm AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted courseid, since the handler validates only...

CVE-2026-112329

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers,...

CVE-2026-112151

A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This manipulation of the argument...

CVE-2026-112150

A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql injection. The attack can be executed remotely. The exploit has...

CVE-2026-112149

A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This impacts the function moveuploadedfile of the file home.php. The manipulation of the argument myimg leads to unrestricted upload. Remote exploitation of the attack is possible...

CVE-2026-112147

A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiated remotely. The exploit has been made...

CVE-2026-112295

FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/accountupdate. Attackers can change their review status, rename themselves, or duplicate another account'...

CVE-2026-112293

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the teampayments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link,...

CVE-2026-112294

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/modelCode/id/counter ...

CVE-2026-8168

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module QtSvg in Qt Group Qt allows attackers to cause a denial of service application crash via stack exhaustion via a crafted SVG file with deeply nested elements...

CVE-2026-112296

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

CVE-2026-112287

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy...

CVE-2026-112289

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.linktotask. Attackers can embed HTML or script that executes when administrators open the task changelist or change...

CVE-2026-112288

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach internal addresses via DNS rebinding. Attackers can return a public address during WebhookService::isSafeEndpoint validation and an internal address when Guzzle...

CVE-2026-112291

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem path...

CVE-2026-112290

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label ca...

CVE-2026-112292

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections//records endpoints to steal servertoken values and...

CVE-2026-112280

libaribb24 aribb24 through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through...

CVE-2026-112282

VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpiaccesspoint that allows attackers to crash applications by supplying a ClipInfo file with an empty EP-map fine table. Attackers can place a crafted .clpi file in BDMV/CLIPINF with numepfine set to zero and an...

CVE-2026-112284

libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to le...

CVE-2026-112286

Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search and lead-products endpoints to retrieve...

CVE-2026-112283

VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in parseextentstartpoints in clpiparse.c that trusts the numpoint field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge numpoint to exhaust memor...

CVE-2026-112281

libaribb24 aribb24 through 1.0.3 contains a stack-based buffer overflow vulnerability in decoderhandlecsi in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over...

CVE-2026-112285

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

CVE-2026-112275

Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length decoder prloadimage in converter/other/rast.c. Attackers can supply a byte-encoded rasterfile with tiny dimensions and a long run-length body to write controlled bytes past mdimage...

CVE-2026-112273

libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::composename in src/dns.cpp that allows remote attackers to read past the packet buffer by sending a label ending exactly at the packet end. Attackers can deliver crafted DNS packets whose additional, answer, or authority...

CVE-2026-112276

Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap memory by supplying Sun rasterfiles with short colormaps. Attackers can craft colormapped rasterfiles with pixel bytes exceeding the palette length to leak up to 255 adjacent...

CVE-2026-112279

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processbmpcache2 in orders.c that allows malicious RDP servers to crash clients via crafted revision-2 bitmap cache orders. Attackers can send an uncompressed order with large width/height or an underflowing mode nibble an...

CVE-2026-112277

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processplane in bitmap.c that allows malicious RDP servers to crash clients by sending malformed 32 bpp compressed bitmaps. Attackers can declare a large bitmap geometry with a short compressed body in bitmap update PDUs o...

CVE-2026-112278

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in processrawbmpcache in orders.c that allows malicious RDP servers to crash clients. Attackers can send a raw bitmap cache order declaring large width, height, and bpp values with a tiny payload, causing memcpy to read past...

CVE-2026-112274

libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soarecord::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causin...

CVE-2026-112271

libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to...