CVE-2026-15478

IceHRM

CVE-2026-15477

Bahmni bahmnicore (up to 0.93) is affected in the Search Endpoint (file /openmrs/ws/rest/v1/bahmnicore/sql), specifically the function additionalParams. A manipulated argument can lead to SQL injection, with remote exploitation possible and public exploit details. Remediation: upgrade to 0.93.1, ...

CVE-2026-15476

CVE-2026-15476 affects QILING Disk Master 6.0.0.0 and its Kernel Driver component diskbckp.sys, where an unknown function in that library enables local privilege escalation via improper access controls. The vulnerability is local, with low attack complexity and proof-of-concept exploit maturity r...

CVE-2026-15475

Summary: CVE-2026-15475 affects MiniTool Partition Wizard (up to v13.6), specifically the Signed Kernel Driver pwdrvio.sys. A manipulation of an unknown function in pwdrvio.sys leads to improper access controls. The attack is local. Publicly available exploit suggests potential use in attacks. A ...

CVE-2026-15474

CVE-2026-15474 affects Eleveo Call Recording Software 9.7.0. The vulnerability resides in the /callrec/audio.jsp component of the Call Recording Handler, where manipulating the argument callId leads to improper authorization. The issue is exploitable remotely, and public exploit code/attack mater...

CVE-2026-15473

The CVE-2026-15473 entry concerns Eleveo Call Recording Software 9.7.0. The issue affects the Recorded Calls Page’s file handling at /callrec/restoreCallAction.do, where processing leads to improper authorization. The vulnerability is exploitable remotely, with exploit code described as PROOF-OF-...

CVE-2026-15472

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2025-56000

Technical details for CVE-2025-56000 are not publicly available in the provided documents. The Fedora update mentions xorg-x11-server but does not link to this CVE. Monitor for updates to obtain concrete affected products, impact, or remediation.

CVE-2026-15471

Eleveo Call Recording Software 9.7.0 contains a vulnerability in an unknown portion of /callrec/pci_dss_status.jsp that allows improper authorization. The issue supports remote exploitation and the exploit has been made public. No remediation details are provided in the document. Vendor contact o...

CVE-2026-59959

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-15470

Technical details (affected product, versions, root cause, exploit specifics) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-58281

CVE-2026-58281 — Microsoft Edge (Chromium-based) Root cause: Deserialization of untrusted data in Edge may allow remote code execution. The vulnerability is exploitable over a network and falls under a high severity (CVSS v3.1 base score 8.3; AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Impact: Unauthor...

CVE-2026-10660

The CVE-2026-10660 issue affects the Zephyr Bluetooth BAP Broadcast Assistant GATT client (subsys/bluetooth/audio/bap_broadcast_assistant.c). A single static net_buf_simple buffer (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512) is shared across all connections; per-connection state (BUSY flag, long-rea...

CVE-2026-61861

CVE-2026-61861 affects ImageMagick prior to 7.1.2-26. A use-after-free in the FormatMagickCaption path occurs when memory allocation fails, allowing a dangling pointer to reference freed memory. This can lead to denial of service or potentially arbitrary code execution. Multiple sources (NVD, Deb...

CVE-2026-61870

ImageMagick before 7.1.2-26 contains a memory leak in the VIFF encoder when memory allocation fails. An attacker can trigger allocation failures by processing specially crafted VIFF images to exhaust memory and cause a DoS. Remediation: upgrade to ImageMagick 7.1.2-26 or later; apply vendor patch...

CVE-2026-61858

CVE-2026-61858 concerns ImageMagick prior to 7.1.2-26, where a policy bypass vulnerability exists in the APNG encoder and external delegates due to missing validation checks. Attackers can bypass policy restrictions during APNG encoding and write files to disallowed paths. The provided documents ...

CVE-2026-61857

CVE-2026-61857 affects ImageMagick prior to 7.1.2-26. The issue is a heap use-after-free caused by a missing null check when parsing XMP profiles, allowing crafted images to trigger crashes. Public advisories from multiple vendors (Ubuntu, Debian, Red Hat, Debian, NVD, etc.) describe the vulnerab...

CVE-2026-61465

ImageMagick before 7.1.2-26 and 6.9.13-51 lacks a check for the allowed memory allocation limit in matrix-backed operations (e.g., -canny). A crafted image can cause ImageMagick to allocate more memory than policy permits, resulting in a denial of service. Affected components: ImageMagick's memor...

CVE-2026-61454

CVE-2026-61454 affects Grav's Admin2 plugin prior to 2.0.4. The vulnerability arises from embedding a global JavaScript variable, window.GRAV_CONFIG , in the Admin2 SPA bootstrap page at /grav/admin and subroutes. This object is returned in every unauthenticated response and exposes server URL, A...

CVE-2026-61447

PraxionAI before 1.6.78 exposes a remote code execution flaw in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandboxing. This enables prompt-injection to exfiltrate environment secrets and run arbitrary code on the host. The v...