VulDB Recent Entries

A vulnerability has been found in moleculerjs Moleculer up to 0.14.35/0.15.1 and classified as problematic. This affects the function Parser._write of the file src/transporters/tcp/parser.js of the component TCP Transporter. Performing a manipulation results in resource consumption. This vulnerability is known as CVE-2026-97705. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

A vulnerability, which was classified as critical, was found in Solidtime-io Solidtime up to 0.15.x. The impacted element is the function TogglDataImporter::importData of the file projects.json of the component Importer. Such manipulation of the argument ID leads to path traversal. This vulnerability is traded as CVE-2026-76806. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Espressif ESP-IDF up to 5.2.8/5.3.6/5.4.4/5.5.5/6.0.2. The affected element is the function dns_lookup of the file dns.c of the component DNS Resolver. This manipulation causes buffer overflow. This vulnerability appears as CVE-2026-113783. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability classified as problematic was found in Zulip up to 12.1. Impacted is an unknown function of the component Users Endpoint. The manipulation of the argument include_custom_profile_fields results in improper access controls. This vulnerability is reported as CVE-2026-115574. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in Espressif ESP-IDF up to 5.5.5/6.0.3/6.1.0. This issue affects the function esp_tee trap entry of the file esp_tee_vectors_plic.S of the component TEE Trap Handler. The manipulation leads to improper privilege management. This vulnerability is documented as CVE-2026-113780. The attack needs to be performed locally. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in OmniAuth up to 2.1.x. This vulnerability affects unknown code of the component Provider Callback URL Derivation. Executing a manipulation can lead to injection. This vulnerability is registered as CVE-2026-63183. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in Zulip up to 12.1. This affects an unknown part of the component Direct Message Drafts. Performing a manipulation results in improper privilege management. This vulnerability is cataloged as CVE-2026-115474. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability labeled as critical has been found in Bitcoinjs-Lib up to 5.2.0/6.1.7/7.0.1. Affected by this issue is the function Block.checkMerkleRoot of the component Merkle Root Verification. Such manipulation leads to improper input validation. This vulnerability is listed as CVE-2026-107846. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

A vulnerability identified as problematic has been detected in Zulip up to 12.1. Affected by this vulnerability is an unknown functionality of the file /messages/render of the component Markdown Rendering. This manipulation of the argument content causes allocation of resources. This vulnerability is tracked as CVE-2026-97701. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in Zammad up to 7.1.1. Affected is an unknown function of the component Vue-based ticket interface. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-102345. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in Espressif ESP-IDF up to 5.2.7/5.3.5/5.4.4/5.5.4/6.0.2. It has been rated as critical. This impacts an unknown function of the component Neighbor Discovery Packet Handler. The manipulation leads to out-of-bounds write. This vulnerability is referenced as CVE-2026-113782. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been declared as critical. This affects an unknown function of the file /admin/manage_booked.php. Executing a manipulation of the argument ID can lead to sql injection. The identification of this vulnerability is CVE-2026-122191. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in SourceCodester Online Food Ordering System 1.0. It has been classified as problematic. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site scripting. This vulnerability was named CVE-2026-122190. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability was found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5 and classified as critical. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component CUDA Optimizer. Such manipulation of the argument per_channel/bit_width/tensor_max/tensor_min/scale leads to out-of-bounds read. This vulnerability is uniquely identified as CVE-2026-122189. The attack can be launched remotely. Moreover, an exploit is present. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in DeepGraphLearning KnowledgeGraphEmbedding up to 2e440e0f9c687314d5ff67ead68ce985dc446e3a and classified as critical. Impacted is the function override_config of the file codes/run.py of the component Checkpoint Loading. This manipulation of the argument data_path causes path traversal. This vulnerability is handled as CVE-2026-122188. The attack can be initiated remotely. Additionally, an exploit exists. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability, which was classified as problematic, was found in DeepSeek-AI DeepSeek Harness up to 0.1.2-alpha.1. This issue affects some unknown processing of the component Control Plane. The manipulation results in missing authentication. This vulnerability is known as CVE-2026-82033. Attacking locally is a requirement. No exploit is available. Applying a patch is advised to resolve this issue.

A vulnerability, which was classified as critical, has been found in myshell-ai AIlice up to 0.4.0. This vulnerability affects the function LoadModel_PEFT of the file ailice/core/llm/AModelCausalLM.py of the component HuggingFace Model Wrapper. The manipulation of the argument base_model_name_or_path leads to inclusion of functionality from untrusted control sphere. This vulnerability is traded as CVE-2026-122160. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability classified as critical was found in Edge0-AI Audio8_TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.__init__ of the file onnx_runtime_0_1b_int8/arktts_runtime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slow_decode_models can lead to path traversal. This vulnerability appears as CVE-2026-122159. The attack may be performed from remote. In addition, an exploit is available. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability classified as problematic has been found in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies[].id/companies[].role results in improper access controls. This vulnerability is reported as CVE-2026-122158. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. This vulnerability is documented as CVE-2026-122157. The attack can be executed remotely. Additionally, an exploit exists. Upgrading the affected component is recommended.