CVE-2026-97650

The ningzichun student-management-system (up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf ) is vulnerable to Cross-Site Scripting (XSS) . The flaw exists in the echo function within the admin/fun/addLog.php file, where improper handling of the reason/detail arguments allows for remote scrip...

CVE-2026-97724

A prototype pollution vulnerability exists in Software Mansion React Native Worklets prior to version 0.12.2 . An attacker can provide a controlled object containing a proto property to modify the prototype of an object during serialization within the clonePlainJSObject function in packages/rea...

CVE-2026-97723

The madpsy ka9q_ubersdr software, in versions before 0.1.58 , is susceptible to a stored cross-site scripting (XSS) vulnerability within the chat message rendering functionality. The root cause is the insufficient neutralization of user-controlled URLs before they are converted into HTML links. S...

CVE-2026-97649

A flaw exists in the ningzichun student-management-system (up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf ) involving an unknown functionality within the example_lite.sql file. An attacker can perform a remote manipulation to achieve the use of default credentials . While the exploit has b...

CVE-2026-95811

The Lemonldap::NG::Handler for Perl is vulnerable to a path traversal-like bypass in versions 2.0.0 to 2.16.10 , 2.17.0 to 2.21.6 , and 2.22.0 to 2.23.4 . The root cause is a discrepancy where the handler matches locationRules against the raw REQUEST_URI, while the web server routes based on a pe...

CVE-2026-97648

A cross-site request forgery (CSRF) vulnerability exists in the ningzichun student-management-system (up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf). An attacker can remotely initiate an attack by manipulating an unknown function to perform unauthorized actions. While the exploit is publi...

CVE-2026-97647

The ningzichun student-management-system (up to version 98760f5711cf6dc8b4adca53a9e207ca49b02ebf ) contains a security vulnerability in the user/editLog.php file. An attacker can perform a remote authorization bypass by manipulating specific arguments, including sid , addtime , type , reason , de...

CVE-2026-91148

The cockpit web console, used for Linux server administration, is vulnerable to a security issue involving unsanitized URLs from PackageKit . This vulnerability is addressed in version 368-1 of the software. Impact details and specific exploit vectors are not provided in the documentation. Remedi...

CVE-2026-92289

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl are vulnerable to a PKCE bypass in "PKCE or secret" mode. The root cause is that the checkEndPointAuthenticationCredentials function fails to verify the client secret for public Relying Parties. When oidcRPMetaDataOptionsRequirePKC...

CVE-2026-97646

A vulnerability exists in the ningzichun student-management-system (up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf ) within the admin/fun/getStudent.php file. The root cause is an authorization bypass triggered by the manipulation of the sid argument. This flaw can be exploited remotely . ...

CVE-2026-92288

The Lemonldap::NG::Portal component for Perl is vulnerable in versions 2.20.0 before 2.21.6 and 2.22.0 before 2.23.4 . The root cause is that the checkEndPointAuthenticationCredentials function fails to verify the client secret for Relying Parties marked as public , while still allowing the reque...

CVE-2026-53493

The open-source container runtime containerd is vulnerable to a Denial of Service (DoS) attack prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1. A crafted OCI index graph can cause extreme CPU and memory usage during the PullImage operation, leading to significant ContainerCreating stall...

CVE-2026-85417

Brocade SANnav versions prior to 3.0.1a are vulnerable to incomplete property masking within the logging subsystem. Under specific configuration conditions, this flaw allows SNMP authentication and privacy passwords to be recorded in plain text within application logs. Attackers with read access ...

CVE-2026-5431

CVE-2026-5431 identifies a critical Remote Code Execution (RCE) vulnerability in Adobe Commerce and Magento (CVSS 9.8). While specific technical root causes are not yet released, the flaw is confirmed to be actively exploited in the wild and is considered potentially wormable . Affected users are...

CVE-2026-52622

Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal models WES100 , WES270 , WES280 , and WES290 (versions prior to 08-08-2023) are vulnerable to a remote information disclosure flaw. An attacker can obtain sensitive information by exploiting a vulnerability in the global API req...

CVE-2026-79153

The Seclore FileSecure Desktop Client before version 3.25.1.0 contains an improper access control vulnerability within its kernel-mode driver component. This flaw allows an authenticated local user to achieve privilege escalation to NT AUTHORITY\SYSTEM on affected systems. No specific exploit cod...

CVE-2025-51457

The D-Link DAP-2610 router, running firmware version up to 2.06B08r099 , is susceptible to an authenticated command injection vulnerability. This flaw exists within the web interface at the /index.xgi endpoint, where an attacker with valid credentials can exploit specific parameters to execute ar...

CVE-2026-88420

A reflected cross-site scripting (XSS) vulnerability exists in the EntryAbstract.save() component of APSL puput versions v1.2.1 through v2.2.0 . This flaw allows authenticated attackers possessing Wagtail Editor privileges to execute arbitrary code within a victim's browser by providing a crafted...

CVE-2026-88421

APSL puput versions v1.2.1 through v2.2.0 are vulnerable to an incorrect access control flaw in the BlogPage.get_entries() component. This vulnerability allows unauthenticated attackers to view restricted blog entries through multiple access points, including the blog index, tag, category, author...

CVE-2026-78902

A Cross Site Scripting (XSS) vulnerability exists in Netgate pfSense 26.03.1-RELEASE . This flaw specifically affects the pfBlockerNG package , potentially allowing an attacker to achieve arbitrary code execution . No specific remediation or exploit details are provided in the documents.