Overview of incoming advisories.
2019 results found
A vulnerability has been identified in the light0011 CMS affecting the file App/Home/Model/UserModel.class.php within the Cookie Helper component. The flaw allows an attacker to manipulate the Username argument, leading to improper authentication. The attack can be executed remotely, and a public exploit is already available, increasing the risk of active exploitation. The affected product uses a rolling release model, so no specific version information is disclosed. The project maintainer was notified via an issue report but has not yet responded. The vulnerability is tracked as CVE-2026-86306 and is referenced in both the NVD and VulDB databases.
View original advisory →A security vulnerability has been identified in sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. The vulnerability resides in the updateOrderSta1/updateOrderdiseaseInfo functions within the OrderController.java file of the Order Handler component. Manipulation of the userID/id arguments allows an attacker to bypass authorization controls. The vulnerability can be exploited remotely, and a public exploit has already been disclosed. The project uses a rolling release strategy, making it difficult to specify exact affected or patched versions. The vendor was notified via a GitHub issue report but has not responded. This poses a risk to healthcare order management systems using this software.
View original advisory →A vulnerability has been identified in SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0. The flaw resides in the file db.php, where improper handling leads to hard-coded credentials being exposed. This vulnerability can be exploited remotely by attackers without requiring physical access to the system. The exploit has been publicly disclosed and is available for use, increasing the risk of active exploitation. Hard-coded credentials typically allow unauthorized access to backend systems, including databases. The issue is classified as a high-severity vulnerability due to its remote exploitability and public exploit availability. Organizations using this LMS platform are advised to apply patches or mitigations immediately. The vulnerability was reported via VulDB and is tracked under CVE-2026-86276.
View original advisory →A server-side request forgery (SSRF) vulnerability has been identified in projeto-siga siga up to version 11.1.1. The vulnerability exists in the function DownloadExterno.getUrl within the file ExUtilController.java, part of the HTML-to-PDF Endpoint component. An attacker can manipulate the 'html' argument to trigger SSRF attacks remotely. A public exploit is already available, increasing the risk of active exploitation. The project maintainers were notified via an issue report but have not yet responded or released a patch. The vulnerability is remotely exploitable and poses a significant risk to deployments of the affected software.
View original advisory →A critical command injection vulnerability has been discovered in D-Link DIR-895L firmware version A1_102b07. The flaw exists in the sendACK function within the udhcpcd/serverpacket.c file of the udhcpcd component. An attacker can manipulate the Hostname argument to inject arbitrary commands. The vulnerability is remotely exploitable without physical access to the device. A public exploit has already been released, increasing the risk of active exploitation. The affected component is the DHCP client daemon (udhcpcd), which handles network configuration. This type of vulnerability in home/small business routers poses significant risks to network security. D-Link has been referenced in the advisory, suggesting a vendor patch or advisory may be forthcoming. The issue is tracked under CVE-2026-86295 and has been documented across multiple vulnerability databases including VulDB and NVD.
View original advisory →A vulnerability identified as CVE-2026-86277 has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System version 1.0. The vulnerability resides in the file delete_exam.php, where manipulation of the ID argument leads to an authorization bypass (IDOR/Broken Access Control). The flaw allows remote attackers to bypass access controls and potentially delete exam records without proper authorization. The exploit has been publicly disclosed and is available for use, increasing the risk of active exploitation. The vulnerability is remotely exploitable, requiring no physical access. It has been categorized as an Insecure Direct Object Reference (IDOR) issue. No patch or mitigation has been noted in the article. Users of the affected system are at risk until a fix is applied.
View original advisory →CVE-2026-6223 describes an improper restriction of excessive authentication attempts vulnerability in the Bahçelievler Municipality BiHayat mobile application. This flaw allows attackers to perform authentication bypass, potentially gaining unauthorized access to user accounts. The affected versions span from 2.1.7 through 07092026. The vulnerability is classified under CWE for brute-force or unlimited login attempts without lockout mechanisms. The vendor was contacted prior to public disclosure but did not respond. The disclosure was published via the Turkish cybersecurity authority siberguvenlik.gov.tr as well as the NVD. No patch or mitigation has been confirmed from the vendor side.
View original advisory →league/commonmark (thephpleague/commonmark) versions 2.7.0 through 2.9.0 contain a cross-site scripting (XSS) vulnerability in the AttributesExtension. Attackers can prefix attribute names with a U+000C form feed byte to bypass the AttributesHelper::filterAttributes() event-handler filter, as PHP's trim() does not strip this character. This allows injection of event handlers like onclick into rendered HTML. The same bypass also defeats the allow_unsafe_links check, permitting javascript: URIs in href/src attributes even when the setting is disabled. Exploitation requires that untrusted Markdown is processed with the AttributesExtension enabled. The injected script executes when the rendered HTML is viewed by a victim's browser. The vulnerability has been fixed in version 2.9.1.
View original advisory →A critical Missing Authorization vulnerability (CVE-2026-61410) has been identified in Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted request to the application, bypassing code execution restrictions and achieving remote command execution. The vulnerability is rated critical due to its unauthenticated and remote exploitability. No credentials are required to exploit this flaw, significantly lowering the barrier for attackers. Dell has issued a security advisory (DSA-2026-382) and strongly recommends customers upgrade to the patched versions at the earliest opportunity.
View original advisory →A SQL injection vulnerability has been identified in itsourcecode School Management System version 1.0. The vulnerability exists in the User_Login.php file, where manipulation of the 'email' argument allows an attacker to perform SQL injection. The attack can be executed remotely without requiring local access. A public exploit is already available, increasing the risk of active exploitation. The affected function within User_Login.php is not fully identified but the attack vector is well-documented. This vulnerability poses a significant risk to institutions using this school management software. Organizations running this system should apply patches or mitigations immediately to prevent unauthorized database access or data breaches.
View original advisory →A vulnerability has been identified in SourceCodester Simple Traffic Offense System version 1.0. The flaw resides in the file saveuser.php within the User Creation component. By manipulating the 'position' argument, an attacker can bypass authentication controls entirely. The vulnerability is remotely exploitable without requiring prior authentication or user interaction. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a PHP-based web application commonly used for traffic violation management. The missing authentication flaw could allow unauthorized users to create or manipulate user accounts. This represents a significant access control weakness with potential for full system compromise. Organizations using this software should apply mitigations or remove public exposure immediately.
View original advisory →LibreNMS versions before 26.8.0 are affected by an argument injection vulnerability in the graph_title parameter. Authenticated attackers can break out of double-quote escaping to inject arbitrary rrdtool arguments. By injecting DEF and LINE arguments, attackers can read RRD files from devices they are not authorized to access. Additionally, newline injection can be used to execute arbitrary rrdtool commands, effectively bypassing per-device authorization checks. The vulnerability requires authentication but can lead to unauthorized data access and command execution within the rrdtool context. A fix is available in LibreNMS version 26.8.0 and later. Security advisories have been published on GitHub and VulnCheck detailing the issue and remediation steps.
View original advisory →PocketMine-MP versions prior to 3.26.5 and 4.0.5 contain a vulnerability where skin data fields submitted by players are not properly validated for length. This allows attackers to submit oversized values that exceed the 32767 byte TAG_String limit used in NBT data serialization. Fields such as skinID and geometryName can be exploited by sending oversized data, triggering exceptions during NBT serialization and causing server crashes. The vulnerability enables unauthenticated remote attackers to perform denial-of-service attacks against PocketMine-MP game servers. Fixes were introduced in versions 3.26.5 and 4.0.5 with proper input length validation.
View original advisory →A SQL injection vulnerability has been identified in jaychouchannel's Tourism-Management-System up to commit 8122bf020d91199eddfff3ee02d1632a70a9a132. The vulnerability resides in the file travel/src/main/java/com/controller/CommonController.java within the CommonDao component. Attackers can manipulate the table, column, xColumn, and yColumn arguments to execute SQL injection attacks remotely. The exploit has been publicly disclosed, increasing the risk of active exploitation. The product does not use versioning, making it difficult to identify affected and unaffected releases. A patch (commit d44ec3aa0bd2a72c8800e3befb0a9a96a6491b86) has been made available and should be applied immediately. The vulnerability was reported via GitHub issues and pull requests and tracked on VulDB as well as NVD.
View original advisory →A critical OS command injection vulnerability has been identified in the Linksys RE7000 range extender running firmware version 2.0.15. The vulnerability exists in the platform_event_pingTest function accessible via /cgi-bin/json.cgi?PingTest endpoint. Attackers can manipulate the arguments pingTestIp, pingTestPktSize, and pingTestTimes to inject arbitrary OS commands. The attack can be executed remotely without physical access to the device. A public exploit is already available, significantly increasing the risk of active exploitation. The vulnerability affects the PingTest Handler component of the device's CGI interface. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Given the public availability of the exploit and the remote attack vector, this is considered a high-severity issue.
View original advisory →A critical vulnerability was discovered in FreeIPA where the self-managed OTP token Access Control Instruction (ACI) neither requires authentication nor restricts which attributes may be added alongside a token entry. An unauthenticated LDAP client can exploit this flaw, in combination with a related directory server ACI evaluation vulnerability, to create an attacker-controlled Kerberos principal and insert it into the FreeIPA administrators group. This grants the remote, unauthenticated attacker full FreeIPA administrator-group membership, enabling administrative operations against the directory. On SID-enabled deployments, the impact extends to other Identity Management (IdM) services. The flaw represents a severe authentication bypass leading to complete privilege escalation. It is tracked under CVE-2026-76578 and referenced in Red Hat security advisories and Bugzilla.
View original advisory →CVE-2026-86428 affects the commonmark PHP library versions 1.5.0 through before 2.10.0. The vulnerability exists in the AttributesExtension component, which fails to efficiently handle Markdown input containing numerous distinctly-named attributes. Attackers can craft malicious Markdown payloads with many unique attribute names to trigger quadratic-time complexity during attribute merging and filtering operations. This results in excessive CPU consumption, effectively causing a denial of service condition. Legitimate requests are prevented from completing while the server processes the malicious input. The issue is classified as a denial of service vulnerability with a high criticality rating. Users are advised to upgrade to commonmark version 2.10.0 or later to remediate the vulnerability. The flaw was disclosed via GitHub Security Advisories and VulnCheck.
View original advisory →A critical vulnerability has been identified in Tenda AC9 firmware version 15.03.05.14, specifically affecting the R7WebsSecurityHandler function within the Web Management component. The flaw results in improper authentication, allowing attackers to bypass authentication mechanisms remotely. The vulnerability can be exploited without local access, significantly increasing its risk profile. A public exploit has already been published, raising the likelihood of active exploitation in the wild. The affected product is a widely used consumer and small business router manufactured by Tenda. The vulnerability has been assigned CVE-2026-86300 and is tracked on NVD and VulDB. Multiple proof-of-concept references have been published on GitHub detailing unauthorized password setting and product information disclosure. Organizations and individuals using the Tenda AC9 router are advised to apply patches or mitigations immediately.
View original advisory →A vulnerability identified as CVE-2026-86303 was discovered in the 92181 markdown library up to commit 058cab0cb7fb245a0ccc6b8446963ff8d573558f. The vulnerability affects the function 'lds' in the file md.c, where a crafted manipulation can trigger an out-of-bounds read condition. The attack can be executed remotely, increasing its risk profile. The product uses a rolling release model, making version-based tracking unavailable. A patch commit (c000d2f9cf390c315378d3717cf20911cf3e80a6) has been identified and should be applied to remediate the issue. The vulnerability is tracked on both NVD and VulDB platforms. No authentication details or CVSS scores are mentioned in the article. Users of the affected library are advised to apply the available patch immediately.
View original advisory →league/commonmark versions before 2.9.1 are affected by multiple denial of service vulnerabilities in their Markdown parsing logic. Specifically, the fenced code block detection, reference link label lookup, and emphasis delimiter processing perform super-linear (potentially exponential) work on specially crafted input. Attackers can exploit this by submitting Markdown content containing long backtick runs, deeply nested brackets, or complex delimiter sequences. This causes disproportionate CPU consumption on the server, effectively blocking legitimate requests from completing. The vulnerability is classified as a ReDoS or algorithmic complexity attack vector. A fix is available in version 2.9.1 of the library. The issue has been documented across multiple security advisories including a GitHub Security Advisory and a VulnCheck entry.
View original advisory →