Aggregator

Submit #749713 / VDB-344886

A vulnerability was found in Tenda RX3 16.03.13.11. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. This vulnerability was named CVE-2026-2181. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability was found in Tenda RX3 16.03.13.11. It has been declared as critical. Affected is an unknown function of the file /goform/fast_setting_wifi_set. Such manipulation of the argument ssid_5g leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-2180. The attack can be launched remotely. Moreover, an exploit is present.

Submit #749712 / VDB-344885

A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been classified as critical. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. This vulnerability is handled as CVE-2026-2179. The attack can be initiated remotely. Additionally, an exploit exists.

Submit #749710 / VDB-344884

Submit #749703 / VDB-344883

A vulnerability was found in r-huijts xcode-mcp-server up to f3419f00117aa9949e326f78cc940166c88f18cb and classified as critical. This affects the function registerXcodeTools of the file src/tools/xcode/index.ts of the component run_lldb. The manipulation of the argument args results in command injection. This vulnerability is known as CVE-2026-2178. It is possible to launch the attack remotely. Furthermore, an exploit is available. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Applying a patch is advised to resolve this issue.

Submit #749592 / VDB-344882

A vulnerability has been found in SourceCodester Prison Management System 1.0 and classified as critical. The impacted element is an unknown function of the component Login. The manipulation leads to session fixiation. This vulnerability is traded as CVE-2026-2177. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Submit #749569 / VDB-344881

A new state-aligned cyberespionage threat group tracked as TGR-STA-1030/UNC6619, has conducted a global-scale operation dubbed the "Shadow Campaigns," where it targeted government infrastructure in 155 countries. [...]

Submit #749485 / VDB-344880

A vulnerability, which was classified as critical, was found in JAY Login & Register Plugin up to 2.6.03 on WordPress. The affected element is the function jay_panel_ajax_update_profile. Executing a manipulation can lead to improper privilege management. This vulnerability appears as CVE-2025-15100. The attack may be performed from remote. There is no available exploit.

A vulnerability, which was classified as critical, has been found in JAY Login & Register Plugin up to 2.6.03 on WordPress. Impacted is the function jay_login_register_ajax_create_final_user. Performing a manipulation results in improper privilege management. This vulnerability is reported as CVE-2025-15027. The attack is possible to be carried out remotely. No exploit exists.

Submit #749475 / VDB-263104

Submit #749474 / VDB-259631

Submit #749473 / VDB-259630

A vulnerability classified as critical was found in code-projects Contact Management System 1.0. This issue affects some unknown processing of the file index.py. Such manipulation of the argument selecteditem[0] leads to sql injection. This vulnerability is documented as CVE-2026-2176. The attack can be executed remotely. There is not any exploit available.

A vulnerability classified as critical has been found in D-Link DIR-823X 250416. This vulnerability affects the function sub_420618 of the file /goform/set_upnp. This manipulation of the argument upnp_enable causes os command injection. This vulnerability is registered as CVE-2026-2175. Remote exploitation of the attack is possible. Furthermore, an exploit is available.