CVE-2026-97xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
716 records · Page 2 of 8
Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affe
Updated- CVE-2026-97897: Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting 5.1 Medium
A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d34
Updated A vulnerability was identified in krayin laravel-crm up to 2.2.5. This vulnerability affects the function ConfigurationForm::rules of the file packages/Webkul/Admin/src/Http/Requests/ConfigurationForm.php of the component Upload Functionality. The manipulation leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Upgr
Updated- CVE-2026-97895: krayin laravel-crm User Management UserController.php privileges management 5.3 Medium
A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role_id can lead to improper privilege management. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized
Updated A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates
UpdatedA flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty.php. This manipulation of the argument fid causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. This product uses a rolling release model to deliver continuous updates. As a
UpdatedA vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatestudent.php of the component Student Update Functionality. The manipulation of the argument eno results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. This product does not use v
UpdatedA security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. The manipulation of the argument gid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is use
UpdatedA weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available t
Updated- CVE-2026-97879: zhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication 6.9 Medium
A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. The affected element is an unknown function of the file SecurityConfig.java of the component api-docs Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early
Updated - CVE-2026-97878: zhistaredu StarTraining Druid Console index.html anonymous missing authentication 6.9 Medium
A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid Console. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Updated A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file application.yml of the component JWT Token Handler. This manipulation of the argument user_id/company_id causes use of hard-coded password. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The
UpdatedA local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, r
UpdatedRojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious webpage can read all project source, write malicious code to files on disk, and launch local programs via opener::open() with no user interaction beyond visiting the page.
UpdatedIn Bouncy Castle for Java before 1.86, the raw JCA provider's legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families ran their password-based key derivation with an iteration count taken from untrusted input without bounding it, so a small input could dictate an arbitrary amount of work before anything could be verified. The AlgorithmParameters implementations (PKCS12PBE and its object identifier
UpdatedA vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclos
UpdatedA flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is stated that the ex
UpdatedA security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclo
UpdatedA weakness has been identified in Zhonglun CloudPOS 3.0. Affected by this vulnerability is an unknown functionality of the file Program.cs of the component Automatic Update. Executing a manipulation of the argument version/url/packagekey/package name can lead to channel accessible by non-endpoint. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitation appe
UpdatedA security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The patch is named 78c1222ec0e2119d84684032da1541120a2cdd23. The
UpdatedA vulnerability has been found in GibbonEdu Gibbon up to 30.0.01. The affected element is the function makeBlock of the file modules/Planner/units_add_blockAjax.php of the component Unit Planner. The manipulation of the argument gibbonUnitBlockID/mode leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Up
UpdatedThe cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any esca
UpdatedYMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges.
UpdatedSeven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An authenticated user could therefore read the followers, following list, starred and watched repositories and public SSH and GPG keys of a user
UpdatedAn attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.
UpdatedYamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product.
UpdatedMemory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient
UpdatedThe storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.
UpdatedKeycloak provides a feature called mTLS holder-of-key binding which ensures that a token can only be used by the client that originally requested it by binding it to their digital certificate. A flaw was discovered where the new Standard Token Exchange V2 feature does not check for this certificate. This allows an attacker with stolen client credentials to obtain a standard, unrestricted token tha
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedDouble free in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedBuffer over-read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedOut-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedphpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.
UpdatedHeap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over a network.
UpdatedUse after free in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Windows Hyper-V allows an authorized attacker to disclose information over a network.
UpdatedDouble free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
UpdatedDouble free in OpenSSH for Windows allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
Updated- CVE-2026-97805: Windows Partition Management Driver Remote Code Execution Vulnerability 9.8 Critical
Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.
Updated Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedImproper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network.
UpdatedIncorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
UpdatedImproper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.
UpdatedImproper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
UpdatedMissing authentication for critical function in Windows Setup and Deployment allows an authorized attacker to elevate privileges locally.
UpdatedImproper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
UpdatedIn Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forged assertion signed with an untrusted certificate while legitimate requests were being processed, and it
Updated- CVE-2026-97790: Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability 5.5 Medium
Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.
Updated Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
Updated- CVE-2026-97788: Active Directory Federation Services (AD FS) Information Disclosure Vulnerability 7.5 High
Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
Updated Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
UpdatedImproper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
UpdatedObservable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
UpdatedImproper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
UpdatedInteger overflow or wraparound in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedTime-of-check time-of-use (toctou) race condition in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedDouble free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedStack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
UpdatedHeap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Updated