Aggregator

A vulnerability classified as problematic has been found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/api_patient_schedule.php. Performing a manipulation of the argument Reason results in cross site scripting. This vulnerability is cataloged as CVE-2026-1147. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability described as problematic has been identified in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. Affected by this issue is some unknown functionality of the file /php/api_register_patient.php. Such manipulation of the argument firstName/lastName leads to cross site scripting. This vulnerability is listed as CVE-2026-1146. The attack may be performed from remote. In addition, an exploit is available.

Submit #735545 / VDB-341741

Submit #735544 / VDB-341740

Submit #735543 / VDB-341739

A vulnerability marked as critical has been reported in quickjs-ng quickjs up to 0.11.0. Affected by this vulnerability is the function js_typed_array_constructor_ta of the file quickjs.c. This manipulation causes heap-based buffer overflow. This vulnerability is tracked as CVE-2026-1145. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is suggested to install a patch to address this issue.

A vulnerability labeled as critical has been found in quickjs-ng quickjs up to 0.11.0. Affected is an unknown function of the file quickjs.c of the component Atomics Ops Handler. The manipulation results in use after free. This vulnerability is identified as CVE-2026-1144. The attack can be executed remotely. Additionally, an exploit exists. Applying a patch is advised to resolve this issue.

Submit #735541 / VDB-332582

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Ukraine–Germany operation targets Black Basta, Russian leader wanted China-linked APT UAT-8837 targets North American critical infrastructure […]

Submit #735539 / VDB-341738

Submit #735538 / VDB-341737

Submit #735537 / VDB-341737

Submit #735342 / VDB-341599

Submit #735341 / VDB-341599

Submit #735340 / VDB-341599

Чтобы почта ожила, нужно своими руками снести защиту Windows.

本文针对大语言模型（LLM）的后训练安全机制进行了逆向分析与实测研究。作者对比了监督微调（SFT）、偏好对齐（DPO/IPO）及模型表示干预（Abliteration）三种技术路径在消除模型安全拒绝行为上的有效性。

活动时间：2026年1月20日（周二）晚上21:00-23:00 活动平台：智能化软件工程学术沙龙微信群

A vulnerability described as critical has been identified in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/delete_activity.php. Executing a manipulation of the argument activity_id can lead to sql injection. This vulnerability is registered as CVE-2026-1119. It is possible to launch the attack remotely. Furthermore, an exploit is available.