Vuldb Updates

A vulnerability, which was classified as critical, was found in fast-uri up to 4.1.4. Affected by this vulnerability is an unknown functionality of the component Mailto Scheme Parser. Executing a manipulation can lead to encoding error. This vulnerability is registered as CVE-2026-86818. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in netease-youdao LobsterAI 2026.6.15/2026.8.28/2026.9.3/2026.9.4. Impacted is the function OpenClawConfigSync.buildBrowserConfig of the file src/main/libs/openclawConfigSync.ts of the component Browser Network Configuration. The manipulation results in server-side request forgery. This vulnerability is known as CVE-2026-90818. It is possible to launch the attack remotely. Furthermore, an exploit is available. The reported GitHub issue was closed automatically due to inactivity.

A vulnerability, which was classified as problematic, has been found in GPAC 26.07.0. Affected by this issue is the function gf_node_del of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. This vulnerability is tracked as CVE-2026-90826. The attack is restricted to local execution. Moreover, an exploit is present. It is advisable to upgrade the affected component.

A vulnerability was found in GNU Binutils 2.47 and classified as problematic. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. This vulnerability is registered as CVE-2026-90829. The attack needs to be launched locally. Furthermore, an exploit is available. The project was informed of the problem early through a bug report but has not responded yet.

A vulnerability was found in GNU Binutils 2.47. It has been classified as problematic. Impacted is the function _bfd_write_merged_section of the file bfd/merge.c of the component Section Merge. The manipulation leads to null pointer dereference. This vulnerability is documented as CVE-2026-90830. The attack needs to be performed locally. Additionally, an exploit exists. The project was informed of the problem early through a bug report but has not responded yet.

A vulnerability was found in GNU Binutils 2.47. It has been declared as problematic. The affected element is the function _bfd_elf_strtab_delref of the file bfd/elf-strtab.c of the component ELF String Table. The manipulation results in memory corruption. This vulnerability is reported as CVE-2026-90831. The attack requires a local approach. Moreover, an exploit is present. The project was informed of the problem early through a bug report but has not responded yet.

A vulnerability described as critical has been identified in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of the file functions_nmap.py of the component New Nmap Scan Handler. Such manipulation of the argument target/params leads to os command injection. This vulnerability is traded as CVE-2026-90843. The attack may be launched remotely. Furthermore, there is an exploit available. A patch should be applied to remediate this issue. This issue got fixed with a silent patch.

A vulnerability was found in Governikus AusweisApp up to 2.5.4. It has been declared as problematic. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. This vulnerability is tracked as CVE-2026-90848. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component. This CVE was requested by the vendor.

A vulnerability classified as critical was found in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. This vulnerability is known as CVE-2026-90854. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability, which was classified as problematic, was found in Concrete CMS up to 9.5.2. This impacts the function trim of the component YouTube block. Such manipulation of the argument width/height leads to cross site scripting. This vulnerability is traded as CVE-2026-81900. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as problematic was found in Apple iOS and iPadOS up to 26/26.6. The impacted element is an unknown function. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-2026-86890. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability identified as very critical has been detected in Apple macOS up to 26. Impacted is an unknown function. This manipulation causes improper privilege management. This vulnerability is registered as CVE-2026-86894. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

A vulnerability classified as critical has been found in jhb.software Payload 0.7.0. Affected by this vulnerability is the function req.payload.findByID/req.payload.update of the file alt-text/src/endpoints/generateAltText.ts of the component Alt Text Endpoint. Performing a manipulation of the argument id/collection/locale/update results in incorrect authorization. This vulnerability was named CVE-2026-59965. The attack may be initiated remotely. There is no available exploit.

A vulnerability categorized as critical has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the component Avatar Upload. The manipulation of the argument File results in unrestricted upload. This vulnerability is identified as CVE-2026-91849. The attack can be executed remotely. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in Red Hat Buildah, Podman and Skopeo. It has been classified as critical. This issue affects some unknown processing of the component Tar Extraction. This manipulation causes path traversal. This vulnerability appears as CVE-2026-79699. The attack may be initiated remotely. There is no available exploit.

A vulnerability was found in Inspektor Gadget up to 0.53.0. It has been classified as critical. Affected is the function getUsdtInfo of the file pkg/uprobetracer/usdt.go of the component USDT note parser. The manipulation of the argument DescSize/NameSize leads to improper input validation. This vulnerability is documented as CVE-2026-44778. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in IBM MQ up to 10.0.0.0. Impacted is an unknown function of the component TLS Certificate Processing. The manipulation leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-12150. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in IBM Verify Identity Access, Security Verify Access, Verify Identity Access Container and Security Verify Access Container. It has been classified as very critical. This affects an unknown part. This manipulation causes buffer overflow. This vulnerability is registered as CVE-2026-11928. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in IBM Verify Identity Access and Security Verify Access. It has been rated as critical. The impacted element is an unknown function of the component Password Change. The manipulation leads to improper authentication. This vulnerability is documented as CVE-2026-11921. The attack can be initiated remotely. There is not any exploit available.

A vulnerability classified as very critical was found in Google Android. The impacted element is an unknown function. Executing a manipulation can lead to use after free. This vulnerability appears as CVE-2026-56960. The attack may be performed from remote. There is no available exploit. Applying a patch is advised to resolve this issue.