VulDB Recent Entries

A vulnerability described as critical has been identified in Linux Kernel up to 7.3-rc4. This issue affects the function kvm_riscv_vcpu_timer_cancel of the component KVM. Executing a manipulation can lead to use after free. This vulnerability is registered as CVE-2026-98464. The attack needs to be launched locally. No exploit is available. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in Linux Kernel up to 6.12.111/6.18.54/7.2.8/7.3-rc4. This vulnerability affects the function __unmap_stage2_range of the file arch/arm64/kvm/mmu.c of the component KVM MMU. Performing a manipulation results in race condition. This vulnerability is cataloged as CVE-2026-98468. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as very critical has been found in Linux Kernel up to 6.6.157/6.12.111/6.18.54/7.2.8/7.3-rc4. This affects the function hci_bind_cis of the component hci_conn. Such manipulation leads to handling of exceptional conditions. This vulnerability is listed as CVE-2026-98462. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A vulnerability identified as critical has been detected in Linux Kernel up to 7.3-rc4. Affected by this issue is some unknown functionality of the component Bluetooth HCI Socket Security Filter. This manipulation causes improper access controls. This vulnerability is tracked as CVE-2026-98460. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

A vulnerability categorized as very critical has been discovered in Linux Kernel up to 6.6.157/6.12.111/6.18.54/7.2.8/7.3-rc4. Affected by this vulnerability is the function inet_csk_listen_stop of the file net/ipv4/inet_connection_sock.c of the component TCP Listener Stop. The manipulation results in race condition. This vulnerability is identified as CVE-2026-98646. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in beaugunderson ip-address up to 10.7.3. It has been declared as problematic. The affected element is the function Address6.constructor of the component Address6. Such manipulation leads to allocation of resources. This vulnerability is listed as CVE-2026-111997. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability was found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. It has been classified as problematic. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. This vulnerability is tracked as CVE-2026-111993. The attack is restricted to local execution. Moreover, an exploit is present. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 and classified as critical. This issue affects the function Exam::startExam of the file exam.php of the component Exam Module. The manipulation of the argument topicid results in sql injection. This vulnerability is identified as CVE-2026-111992. The attack can be executed remotely. Additionally, an exploit exists. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in WongKinYiu yolov9 0.1 and classified as critical. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads to code injection. This vulnerability is referenced as CVE-2026-111991. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability, which was classified as critical, was found in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the function mysqli_query of the file admin-panel.php of the component Appointment Cancellation Handler. Executing a manipulation of the argument ID can lead to sql injection. The identification of this vulnerability is CVE-2026-111990. The attack may be launched remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability, which was classified as problematic, has been found in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. This vulnerability was named CVE-2026-111988. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation of the argument __metadata__.sshs_model_hash leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-111987. The attack can be launched remotely. Moreover, an exploit is present. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability classified as critical has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injection. This vulnerability is handled as CVE-2026-111986. The attack can be initiated remotely. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability described as problematic has been identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length field results in allocation of resources. This vulnerability is known as CVE-2026-111985. It is possible to launch the attack remotely. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability marked as problematic has been reported in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross site scripting. This vulnerability is traded as CVE-2026-111984. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability labeled as problematic has been found in Apache Camel. The impacted element is an unknown function of the component Thrift. Executing a manipulation can lead to information disclosure. This vulnerability appears as CVE-2026-85245. The attack may be performed from remote. There is no available exploit.

A vulnerability identified as problematic has been detected in Apache Camel. The affected element is an unknown function of the component Camel-Crypto-PGP. Performing a manipulation results in algorithm downgrade. This vulnerability is reported as CVE-2026-85243. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability categorized as problematic has been discovered in Coder up to 2.29.19/2.33.11/2.34.7/2.35.3. Impacted is the function GetWorkspaceProxyByHostname of the file /api/v2/applications/auth-redirect of the component Hostname Validation. Such manipulation leads to improper input validation. This vulnerability is documented as CVE-2026-111927. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in Coder up to 2.34.7. It has been rated as problematic. This issue affects the function handleAPIKeySmuggling. This manipulation of the argument r.URL.Path causes open redirect. This vulnerability is registered as CVE-2026-111931. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

A vulnerability was found in go-vikunja Vikunja up to 2.6.x. It has been declared as problematic. This vulnerability affects unknown code of the component CORS Configuration. The manipulation results in permissive cross-domain policy with untrusted domains. This vulnerability is cataloged as CVE-2026-111922. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.