Aggregator

A vulnerability identified as problematic has been detected in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown functionality of the file /admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html of the component Template Handler. Performing a manipulation results in os command injection. This vulnerability was named CVE-2026-90788. The attack may be initiated remotely. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

Submit #919268 / VDB-403294

Попытка договориться о безопасности может обернуться совсем другой проблемой.

A vulnerability categorized as critical has been discovered in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function RegisterServlet.doPost of the file code/WebContent/register.html of the component Registration Workflow. Such manipulation of the argument level leads to improper privilege management. This vulnerability is uniquely identified as CVE-2026-90787. The attack can be launched remotely. Moreover, an exploit is present. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Submit #919267 / VDB-220016

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. It has been rated as problematic. This impacts the function align_order_members of the file src/compiler/semantics.c of the component Duplicate Symbol Handler. This manipulation causes reachable assertion. This vulnerability is handled as CVE-2026-90786. The attack can be initiated remotely. Additionally, an exploit exists. To fix this issue, it is recommended to deploy a patch.

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. It has been declared as problematic. This affects the function analyze_struct of the file src/compiler/semantics.c of the component Struct Analysis. The manipulation results in reachable assertion. This vulnerability is known as CVE-2026-90785. It is possible to launch the attack remotely. Furthermore, an exploit is available. A patch should be applied to remediate this issue.

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. It has been classified as problematic. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. This vulnerability is traded as CVE-2026-90784. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is suggested to install a patch to address this issue.

Submit #919259 / VDB-403293

北京市政府公布了新修订的《北京市无人驾驶航空器管理规定》，全面限制无人机。《规定》将自 2026 年 11 月 15 日起实施。《规定》明确，本市行政区域全域为无人驾驶航空器管制空域，禁止在本市行政区域内实施无人驾驶航空器飞行活动，禁止在本市行政区域内持有、存放无人驾驶航空器及其核心部件，禁止运输、携带无人驾驶航空器及其核心部件进入本市行政区域。《规定》还要求特殊保障单位应当建立安全管理制度，明确管理责任，防止发生安全事件，特殊保障情形的飞行活动严格按照国家有关规定执行。

Submit #919201 / VDB-403292

Submit #919200 / VDB-403291

Submit #919199 / VDB-403290

A vulnerability was found in Moritz Bunkus MKVToolNix up to 101.0 and classified as problematic. The affected element is an unknown function of the component ODML Superindex Parser. Executing a manipulation can lead to heap-based buffer overflow. This vulnerability appears as CVE-2026-90783. The attack requires local access. There is no available exploit. Applying a patch is advised to resolve this issue.

A vulnerability has been found in Systerel S2OPC up to 1.7.3 and classified as problematic. Impacted is the function msg_subscription_publish_bs__alloc_notification_message_items. Performing a manipulation results in null pointer dereference. This vulnerability is reported as CVE-2026-90782. The attack is possible to be carried out remotely. No exploit exists. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as problematic, was found in ALSA Project alsa-lib up to 1.2.16.1. This issue affects the function __snd_ctl_ascii_elem_id_parse of the component Control Element Identifier Parsing. Such manipulation of the argument Name leads to stack-based buffer overflow. This vulnerability is documented as CVE-2026-90781. The attack needs to be performed locally. There is not any exploit available. It is best practice to apply a patch to resolve this issue.

CVE-2026-85706, a CVSS 10.0 GitLab path traversal, was under active exploitation within 24 hours of disclosure. GitLab disclosed CVE-2026-85706 (CVSS score of 10.0) on September 10, 2026, a path traversal vulnerability in its repository commits API. CVE-2026-85706 affects GitLab’s repository commits API and can let attackers access files they should not see. A crafted request […]

A vulnerability, which was classified as problematic, has been found in SIPp up to 3.7.7. This vulnerability affects the function createAuthHeader. This manipulation causes stack-based buffer overflow. This vulnerability is registered as CVE-2026-90779. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability classified as problematic was found in Nodemailer up to 10.0.4. This affects an unknown part of the component Addressparser. The manipulation results in resource consumption. This vulnerability is cataloged as CVE-2026-90776. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

A vulnerability classified as critical has been found in SIPp up to 3.7.7. Affected by this issue is the function get_header of the file src/sip_parser.cpp. The manipulation leads to buffer overflow. This vulnerability is listed as CVE-2026-90780. The attack may be initiated remotely. There is no available exploit.