Aggregator

A vulnerability was found in react create-react-app up to 5.0.1 on macOS. It has been classified as critical. This affects the function startBrowserProcess of the file openBrowser.js of the component react-dev-utils. Performing a manipulation results in os command injection. This vulnerability is known as CVE-2026-14802. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in GPAC 26.03-DEV-rev342-g80071f700-master and classified as problematic. The impacted element is the function txtin_probe_duration of the file src/filters/load_text.c of the component TeXML File Handler. Such manipulation of the argument txml_timescale leads to divide by zero. This vulnerability is traded as CVE-2026-14801. An attack has to be approached locally. There is no exploit available. A patch should be applied to remediate this issue.

Submit #850857 / VDB-376396

Submit #850854 / VDB-376395

A vulnerability was found in itsourcecode Hospital Management System 1.0. It has been declared as critical. This affects an unknown part of the file /patientreport.php. Executing a manipulation of the argument editid can lead to sql injection. This vulnerability is tracked as CVE-2026-14731. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. It has been rated as critical. This vulnerability affects unknown code of the file /edit_exam.php. The manipulation of the argument ID leads to sql injection. This vulnerability is listed as CVE-2026-14732. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability categorized as critical has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit_coursea.php. The manipulation of the argument ID results in sql injection. This vulnerability is cataloged as CVE-2026-14733. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability identified as critical has been detected in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_product.php. This manipulation of the argument ID causes sql injection. This vulnerability is registered as CVE-2026-14734. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability labeled as critical has been found in code-projects Smart Parking System 1.0. The affected element is an unknown function of the file /parkings/parkings.php. Such manipulation of the argument street/city/status leads to sql injection. This vulnerability is documented as CVE-2026-14735. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability marked as critical has been reported in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a manipulation of the argument upload_image results in unrestricted upload. This vulnerability is reported as CVE-2026-14736. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability classified as critical has been found in Hanwang e-Face General Management Platform 6.3.5.4. This impacts an unknown function of the file /sysAuthStr/querySysAuthStr.do. The manipulation of the argument order leads to sql injection. This vulnerability is traded as CVE-2026-14737. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability classified as problematic was found in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. This vulnerability is known as CVE-2026-14738. It is possible to launch the attack remotely. Furthermore, an exploit is available. The pull request to fix this issue awaits acceptance.

A vulnerability was found in langchain-ai langgraph up to 1.2.4. It has been rated as problematic. The affected element is the function _freeze of the file libs/langgraph/langgraph/_internal/_cache.py of the component Task Result Cache. This manipulation of the argument default_cache_key causes use of weak hash. This vulnerability is tracked as CVE-2026-14742. The attack is possible to be carried out remotely. Moreover, an exploit is present. The pull request to fix this issue awaits acceptance.

A vulnerability categorized as critical has been discovered in code-projects Real State Services 1.0. The impacted element is an unknown function of the file /normalHomeSale.php. Such manipulation of the argument loc leads to sql injection. This vulnerability is listed as CVE-2026-14743. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability identified as critical has been detected in code-projects Real State Services 1.0. This affects an unknown function of the file /normalHomeRent.php. Performing a manipulation of the argument loc results in sql injection. This vulnerability is cataloged as CVE-2026-14744. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability labeled as critical has been found in code-projects Real State Services 1.0. This impacts an unknown function of the file /single-list_rent.php. Executing a manipulation of the argument ID can lead to sql injection. This vulnerability is registered as CVE-2026-14745. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability marked as critical has been reported in code-projects Real State Services 1.0. Affected is an unknown function of the file /addprojectrent.php. The manipulation of the argument amen leads to sql injection. This vulnerability is documented as CVE-2026-14746. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability described as critical has been identified in code-projects Real State Services 1.0. Affected by this vulnerability is an unknown functionality of the file /addprojectsale.php. The manipulation of the argument amen results in sql injection. This vulnerability is reported as CVE-2026-14747. The attack can be launched remotely. No exploit exists.

A vulnerability classified as critical has been found in AIAnytime Awesome-MCP-Server up to a884bb51bcd99e08e14fd712c749d55d9d9a13ab. Affected by this issue is some unknown functionality of the file mcp-wiki/src/mcp_wiki/server.py of the component mcp-wiki/wiki-summary. This manipulation of the argument url causes server-side request forgery. This vulnerability appears as CVE-2026-14748. The attack may be initiated remotely. In addition, an exploit is available. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability identified as problematic has been detected in cve-search up to 6.0.0. The affected element is an unknown function of the component MongoDB Query Handler. Performing a manipulation of the argument collection/fields/filter results in improper input validation. This vulnerability is identified as CVE-2026-59509. The attack can be initiated remotely. There is not any exploit available.