VulDB Recent Entries

A vulnerability has been found in CherryHQ cherry-studio up to 1.9.6 and classified as critical. This vulnerability affects unknown code of the file src/main/services/mcp/oauth/callback.ts of the component MCP OAuth Local Callback Server. The manipulation of the argument code leads to improper authorization. This vulnerability is documented as CVE-2026-13524. The attack can be initiated remotely. Additionally, an exploit exists. The pull request to fix this issue awaits acceptance.

A vulnerability, which was classified as problematic, was found in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/base_encoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. This vulnerability is registered as CVE-2026-13523. The attack needs to be launched locally. Furthermore, an exploit is available. A patch should be applied to remediate this issue. The vendor confirms: "We added a check on inflate output size, if it surpasses 32 times the input size we stop in error. This value could be adjusted later."

A vulnerability, which was classified as problematic, has been found in Investintech SlimPDFReader up to 2.0.14. Affected by this issue is the function SlimPDFReader!Investintech::PCV::TeighaDo+0x25cde0 of the file SlimPDFReader.exe of the component PDF File Handler. Performing a manipulation results in out-of-bounds read. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is cataloged as CVE-2026-13522. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability classified as critical was found in SourceCodester Class and Exam Timetabling System 1.0/5.php. Affected by this vulnerability is an unknown functionality of the file /preview5.php. Such manipulation of the argument course_year_section leads to sql injection. This vulnerability is listed as CVE-2026-13521. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability classified as critical has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /appointmentapproval.php of the component Appointment Handler. This manipulation of the argument editid causes sql injection. This vulnerability is tracked as CVE-2026-13520. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability described as critical has been identified in Tenda JD12L 16.03.53.23. This impacts the function fromNatStaticSetting of the file /goform/NatStaticSetting. The manipulation of the argument page results in stack-based buffer overflow. This vulnerability is identified as CVE-2026-13519. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability marked as critical has been reported in Tenda JD12L 16.03.53.23. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. This vulnerability is referenced as CVE-2026-13518. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability labeled as critical has been found in Tenda JD12L 16.03.53.23. The impacted element is the function formWifiBasicSet of the file /goform/WifiBasicSet. Executing a manipulation of the argument security_5g can lead to stack-based buffer overflow. The identification of this vulnerability is CVE-2026-13517. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability identified as critical has been detected in Tenda JD12L 16.03.53.23. The affected element is the function fromSetWifiGusetBasic of the file /goform/WifiGuestSet. Performing a manipulation of the argument shareSpeed results in stack-based buffer overflow. This vulnerability was named CVE-2026-13516. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability categorized as critical has been discovered in Tenda JD12L 16.03.53.23. Impacted is the function formSetPPTPServer of the file /goform/SetPptpServerCfg. Such manipulation of the argument startIp leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-13515. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability was found in Chess Play and Learn App up to 4.9.42 on Android. It has been rated as problematic. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized control sphere. This vulnerability is handled as CVE-2026-13514. It is feasible to perform the attack on the physical device. Additionally, an exploit exists. Upgrading the affected component is advised. The vendor was informed early about this issue. They confirmed the existence and that they will address it. Furthermore, they explain that their bug bounty "explicitly excludes physical-access attacks". However, they appreciate the quality of the report and aim at making a goodwill payment to the researcher.

A vulnerability was found in MyScale MyScaleDB up to 1.8.0. It has been declared as problematic. This vulnerability affects the function SegmentId::getCacheKey in the library src/VectorIndex/Common/SegmentId.h. The manipulation results in insufficient verification of data authenticity. This vulnerability is known as CVE-2026-13513. It is possible to launch the attack remotely. Furthermore, an exploit is available. The pull request to fix this issue awaits acceptance.

A vulnerability was found in Databend up to 1.2.881 on HTTP. It has been classified as problematic. This affects the function ClientSessionManager::state_key of the file src/query/service/src/servers/http/v1/session/client_session_manager.rs of the component Tenant Handler. The manipulation leads to authorization bypass. This vulnerability is traded as CVE-2026-13512. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The pull request to fix this issue awaits acceptance.

A vulnerability was found in VoltAgent up to 2.1.17 and classified as problematic. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the argument conversationId can lead to improper authorization. This vulnerability appears as CVE-2026-13511. The attack may be performed from remote. In addition, an exploit is available. The pull request to fix this issue awaits acceptance.

A vulnerability has been found in SimStudioAI sim up to 0.6.92 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security/deployment.ts of the component Password Protection Handler. Performing a manipulation results in use of weak hash. This vulnerability is reported as CVE-2026-13510. The attack is possible to be carried out remotely. Moreover, an exploit is present. The pull request to fix this issue awaits acceptance.

A vulnerability, which was classified as critical, was found in RAGapp up to 0.1.5. Affected is the function FileHandler.upload_file/FileHandler.remove_file of the file src/ragapp/backend/controllers/files.py of the component Knowledge File Handler. Such manipulation leads to path traversal. This vulnerability is documented as CVE-2026-13509. The attack can be executed remotely. Additionally, an exploit exists. The pull request to fix this issue awaits acceptance.

A vulnerability, which was classified as critical, has been found in khoj-ai khoj up to 2.0.0-beta.28. This impacts an unknown function of the file src/khoj/routers/api_chat.py of the component Conversation Sharing Handler. This manipulation of the argument conversation.agent causes incorrect authorization. This vulnerability is registered as CVE-2026-13508. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The pull request to fix this issue awaits acceptance.

A vulnerability classified as problematic was found in volcengine OpenViking up to 0.3.21. This affects the function str_to_uint64 of the file openviking/storage/vectordb/utils/str_to_uint64.py of the component Local VectorDB Primary-key Label Handler. The manipulation of the argument ID results in insufficient verification of data authenticity. This vulnerability is cataloged as CVE-2026-13507. The attack may be launched remotely. There is no exploit available. The pull request to fix this issue awaits acceptance.

A vulnerability classified as critical has been found in zephyrproject zephyr up to 4.4.x. The impacted element is the function getaddrinfo of the file subsys/net/lib/sockets/getaddrinfo.c. The manipulation of the argument ai_arr[] leads to use after free. This vulnerability is listed as CVE-2026-10646. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability described as problematic has been identified in zephyrproject zephyr up to 4.4.x. The affected element is the function unicast_client_ep_qos_state of the file subsys/bluetooth/audio/bap_unicast_client.c. Executing a manipulation can lead to null pointer dereference. This vulnerability is tracked as CVE-2026-10593. The attack is only possible within the local network. No exploit exists. Upgrading the affected component is recommended.