VulDB Recent Entries

A vulnerability marked as critical has been reported in Krayin laravel-crm up to 2.2.3. This affects the function havingRaw of the file LeadDataGrid.php of the component DataGrid. The manipulation of the argument rotten_lead[in] leads to sql injection. This vulnerability is listed as CVE-2026-41453. The attack may be initiated remotely. There is no available exploit. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in OpenEMR up to 8.2.0. The impacted element is the function eval of the file library/classes/Tree.class.php of the component Document Category Tree. Executing a manipulation can lead to code injection. This vulnerability is tracked as CVE-2026-39932. The attack can be launched remotely. No exploit exists.

A vulnerability identified as critical has been detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. This vulnerability is identified as CVE-2026-18686. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

A vulnerability categorized as critical has been discovered in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function set_upgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. This vulnerability is referenced as CVE-2026-18685. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. It has been rated as critical. This issue affects the function remove_profile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. The identification of this vulnerability is CVE-2026-18684. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability.

A vulnerability was found in OpenAkita up to 1.27.12. It has been declared as problematic. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. This vulnerability was named CVE-2026-18682. The attack may be performed from remote. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in Wellbia XIGNCODE3 2026.6.1.192. It has been classified as very critical. This affects an unknown part of the file xhunter2.sys of the component IRP_MJ_WRITE command interface. The manipulation leads to improper access controls. This vulnerability is uniquely identified as CVE-2026-15430. Local access is required to approach this attack. No exploit exists.

A vulnerability was found in Red Hat Directory Server and Enterprise Linux and classified as very critical. Affected by this issue is some unknown functionality. Executing a manipulation can lead to improper access controls. This vulnerability is handled as CVE-2026-18651. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in TIMLEGGE XML::Sig up to 0.71 and classified as critical. Affected by this vulnerability is the function verify of the file lib/XML/Sig.pm of the component Signature Verification. Performing a manipulation results in improper verification of cryptographic signature. This vulnerability is known as CVE-2026-18568. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in Fastify aws-lambda 6.4.0. Affected is an unknown function. Such manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-18248. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Free Software Foundation tar. This impacts an unknown function of the component Hardlink Handler. This manipulation causes path traversal. This vulnerability appears as CVE-2026-18508. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as critical was found in Telenia TVox up to 24.9.21/26.5.3. This affects an unknown function of the file /etc/sudoers.d/telenia of the component Sudoers Configuration. The manipulation results in improper privilege management. This vulnerability is reported as CVE-2026-67609. The attack can be launched remotely. No exploit exists.

A vulnerability classified as problematic has been found in GStreamer. The impacted element is an unknown function of the file gstavdemux.c of the component libav. The manipulation leads to null pointer dereference. This vulnerability is documented as CVE-2026-12893. The attack can be initiated remotely. There is not any exploit available.

A vulnerability described as problematic has been identified in Red Hat Keycloak. The affected element is an unknown function of the component keycloak-services. Executing a manipulation can lead to insufficient verification of data authenticity. This vulnerability is registered as CVE-2026-18569. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as critical has been reported in sssd. Impacted is an unknown function of the component PAM responder. Performing a manipulation of the argument auth_token_length results in out-of-bounds read. This vulnerability is cataloged as CVE-2026-68743. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability labeled as problematic has been found in SSSD. This issue affects some unknown processing of the component NSS Responder. Such manipulation leads to uninitialized resource. This vulnerability is listed as CVE-2026-68744. The attack must be carried out locally. There is no available exploit.

A vulnerability identified as problematic has been detected in Admidio up to 5.0.10. This vulnerability affects unknown code of the component SSO/SAML Endpoint. This manipulation of the argument SAML Issuer causes cross site scripting. This vulnerability is tracked as CVE-2026-69092. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

A vulnerability categorized as critical has been discovered in XML::Sig up to 0.70. This affects the function _get_signed_xml of the file lib/XML/Sig.pm. The manipulation of the argument ID results in insufficient verification of data authenticity. This vulnerability is identified as CVE-2026-9487. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in XML::Sig up to 0.70. It has been rated as problematic. Affected by this issue is the function verify/_get_signed_xml of the file lib/XML/Sig.pm of the component XPath Builder. The manipulation of the argument URI leads to injection. This vulnerability is referenced as CVE-2026-9390. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

A vulnerability was found in OpenWrt LuCI. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file bmx7-info.cgi of the component bmx7-info. Executing a manipulation can lead to path traversal. The identification of this vulnerability is CVE-2026-69095. The attack may be launched remotely. There is no exploit available. A patch should be applied to remediate this issue.