Aggregator

Submit #919538 / VDB-403295

A vulnerability identified as problematic has been detected in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. This vulnerability was named CVE-2026-90788. The attack may be initiated remotely. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Submit #919268 / VDB-403294

Попытка договориться о безопасности может обернуться совсем другой проблемой.

A vulnerability categorized as critical has been discovered in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper privilege management. This vulnerability is uniquely identified as CVE-2026-90787. The attack can be launched remotely. Moreover, an exploit is present. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Submit #919267 / VDB-220016

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. It has been rated as problematic. This impacts the function align_order_members of the file src/compiler/semantics.c of the component Duplicate Symbol Handler. This manipulation causes reachable assertion. This vulnerability is handled as CVE-2026-90786. The attack can be initiated remotely. Additionally, an exploit exists. To fix this issue, it is recommended to deploy a patch.

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. It has been declared as problematic. This affects the function analyze_struct of the file src/compiler/semantics.c of the component Struct Analysis. The manipulation results in reachable assertion. This vulnerability is known as CVE-2026-90785. It is possible to launch the attack remotely. Furthermore, an exploit is available. A patch should be applied to remediate this issue.

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. It has been classified as problematic. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. This vulnerability is traded as CVE-2026-90784. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to install a patch to address this issue.

Submit #919259 / VDB-403293

Submit #919201 / VDB-403292

Submit #919200 / VDB-403291

Submit #919199 / VDB-403290

A vulnerability was found in Moritz Bunkus MKVToolNix up to 101.0 and classified as problematic. The affected element is an unknown function of the component ODML Superindex Parser. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability appears as CVE-2026-90783. The attack requires local access. There is no available exploit. Applying a patch is advised to resolve this issue.

A vulnerability has been found in Systerel S2OPC up to 1.7.3 and classified as problematic. Impacted is the function msg_subscription_publish_bs__alloc_notification_message_items. Performing a manipulation results in null pointer dereference. This vulnerability is reported as CVE-2026-90782. The attack is possible to be carried out remotely. No exploit exists. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as problematic, was found in ALSA Project alsa-lib up to 1.2.16.1. This issue affects the function __snd_ctl_ascii_elem_id_parse of the component Control Element Identifier Parsing. Such manipulation of the argument Name leads to stack-based buffer overflow. This vulnerability is documented as CVE-2026-90781. The attack needs to be performed locally. There is not any exploit available. It is best practice to apply a patch to resolve this issue.

CVE-2026-85706, a CVSS 10.0 GitLab path traversal, was under active exploitation within 24 hours of disclosure. GitLab disclosed CVE-2026-85706 (CVSS score of 10.0) on September 10, 2026, a path traversal vulnerability in its repository commits API. CVE-2026-85706 affects GitLab’s repository commits API and can let attackers access files they should not see. A crafted request […]

A vulnerability, which was classified as problematic, has been found in SIPp up to 3.7.7. This vulnerability affects the function createAuthHeader. This manipulation causes stack-based buffer overflow. This vulnerability is registered as CVE-2026-90779. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability classified as problematic was found in Nodemailer up to 10.0.4. This affects an unknown part of the component Addressparser. The manipulation results in resource consumption. This vulnerability is cataloged as CVE-2026-90776. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability classified as critical has been found in SIPp up to 3.7.7. Affected by this issue is the function get_header of the file src/sip_parser.cpp. The manipulation leads to buffer overflow. This vulnerability is listed as CVE-2026-90780. The attack may be initiated remotely. There is no available exploit.