CVE-2026-90598

This authorization bypass in jaygajera17 E-commerce-project-springBoot affects the UserController.updateUser function in UserController.java . An attacker with low privileges can remotely manipulate the userid argument to bypass authorization, resulting in low impact on confidentiality, integrity...

CVE-2026-90597

A SQL injection vulnerability exists in itsourcecode Sales and Inventory System 1.0 , specifically in an unknown function of the file /pages/sup_edit1.php via the ID argument. The flaw allows remote attackers with low privileges to manipulate the parameter and inject SQL, resulting in low impact ...

CVE-2026-90596

embedded-graphics (Rust library) up to 0.8.2 is affected by an integer overflow in the ImageRaw::new/bytes_per_row function (src/image/image_raw.rs) on 32-bit platforms. The flaw can be triggered remotely without authentication or user interaction. Per CVSS 3.1, the impact is rated MEDIUM (6.5) w...

CVE-2026-90595

CVE-2026-90595 is a missing authorization flaw in wxiaoqi Spring-Cloud-Platform versions 1.0, 2.2, and 3.0. The vulnerability resides in the OnlineController.getOnlineInfo function within aceModules/ace-admin/auth/controller/OnlineController.java. A remote attacker with low privileges can exploit...

CVE-2026-90594

A missing authorization (fail-open) vulnerability in the Permission Service of wxiaoqi Spring-Cloud-Platform versions 3.0.1 and 3.1.0 affects the function PermissionService.checkUserPermission in /rpc/service/PermissionService.java. The flaw allows remote attackers with low privileges to bypass p...

CVE-2026-90593

embedded-graphics up to version 0.8.2 is affected by an integer overflow in the function ImageRaw::draw_sub_image (file src/image/image_raw.rs). Manipulating the width argument can trigger the overflow, and the attack may be launched remotely with no authentication or user interaction required. T...

CVE-2026-90584

TooTallNate Java-WebSocket versions up to 1.6.1 are affected by a resource allocation flaw in the Fragmentation Handler , specifically the processFrameContinuousAndNonFin function in Draft_6455.java. A remote attacker with no authentication can trigger the weakness, resulting in low availability ...

CVE-2026-88802

CVE-2026-88802 affects two WordPress plugins: MDJM Event Management (before 1.7.8.5) and Mobile Events Manager (through 1.4.8.3). The root cause is the absence of a capability check, nonce validation, or record-type verification in the plugins' playlist entry removal endpoint. An unauthenticated ...

CVE-2026-89050

The Quads Ads Manager for Google AdSense WordPress plugin, in versions before 3.0.5 , fails to verify payment completion with the configured payment gateway before marking an ad-selling order as paid. This allows authenticated users with the Subscriber+ role who can place an order to obtain a pai...

CVE-2026-88793

The YouTube Embed WordPress plugin (versions 10.0–10.3 ) contains an unauthenticated stored XSS vulnerability in its youram_server AJAX action. The action performs no proper authorization check, relying solely on a nonce that is printed on every front-end page, and does not escape stored data bef...

CVE-2026-85129

CVE-2026-85129 affects the Hoo Companion WordPress plugin version 1.0.2 . The vulnerability resides in the plugin's theme settings import feature , which lacks any authorisation or validation checks and fails to sanitise submitted data before storing it as the active theme's settings. This allows...

CVE-2026-81648

The CryptoPayment Gateway WordPress plugin (versions 1.2.1–1.2.2 ) contains a missing authorization check on an AJAX endpoint , allowing unauthenticated users to invoke administrative operations. Attackers can delete arbitrary files on the server, overwrite the payment gateway configuration , and...

CVE-2026-74933

The GenieWords WordPress plugin, versions 1.5.27 through 1.5.34 , is affected by missing authorization checks on several of its REST API and AJAX actions. Because the plugin decodes stored values before outputting them, an unauthenticated attacker can overwrite the plugin's configuration and inje...

CVE-2026-90583

A cross-site scripting (XSS) flaw exists in kagisearch smallweb (up to commit 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf) in the index function of app/sw.py within the Query String Rendering component. Manipulating the qs argument injects untrusted content into the rendered page. Exploitation requi...

CVE-2026-90582

evanchiu serverless-todo (versions 1.0.3 and 2.0.0) is affected by a remote resource exhaustion vulnerability in the saveTodos function of src/index.js (API Todo Endpoint). An attacker can manipulate the event.body argument to trigger excessive resource consumption, leading to availability degrad...

CVE-2026-90581

nginxWebUI (by cym1102, versions up to 4.4.2 ) is vulnerable to code injection in the MainController.autoUpdate function located at /adminPage/main/autoUpdate. The root cause is manipulation of the url argument, allowing a remote attacker with low privileges (no user interaction required) to exec...

CVE-2026-90580

FlowiseAI Flowise (up to version 3.0.2) contains a server-side request forgery (SSRF) vulnerability in the Evaluations Endpoint . The flaw resides in the axios.post function within packages/server/src/controllers/evaluations/index.ts, where manipulation of the Host or X-Forwarded-Proto header all...

CVE-2026-90579

CVE-2026-90579 affects Cheshire Cat AI up to version 1.9.2 . The flaw resides in the _authorize_http_key function within core/cat/factory/custom_auth_handler.py, where manipulation of the user_id argument leads to missing authentication . An unauthenticated remote attacker can exploit this over t...

CVE-2026-90578

A use-after-free vulnerability exists in the gf_list_count function (utils/list.c) of the MP4Box component in GPAC (affected up to commit f1219cde). The flaw can be triggered via local manipulation with low privileges required and no user interaction, leading to partial compromise of confidential...

CVE-2026-90577

CVE-2026-90577 is a heap-based buffer overflow in the MP4Box component of GPAC (up to commit f1219cde), specifically in the function gf_node_get_field within scenegraph/base_scenegraph.c. The vulnerability requires local access with low privileges and no user interaction, resulting in low impact ...