Vuldb Updates

A vulnerability, which was classified as problematic, was found in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. This vulnerability is cataloged as CVE-2026-19895. The attack may be launched remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in mangroup dtale up to 3.22.0 and classified as problematic. This vulnerability affects the function build_secret_key of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. This vulnerability is registered as CVE-2026-19896. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The pull request to fix this issue awaits acceptance.

A vulnerability was found in mangroup dtale up to 3.22.0 and classified as problematic. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper restriction of excessive authentication attempts. This vulnerability is documented as CVE-2026-19897. The attack can be executed remotely. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in VictoriaMetrics up to 1.146.0. It has been classified as problematic. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. This vulnerability is reported as CVE-2026-19898. The attack is possible to be carried out remotely. Moreover, an exploit is present. Upgrading the affected component is recommended.

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. It has been declared as critical. The affected element is an unknown function of the file /edit_teacher.php. Executing a manipulation of the argument ID can lead to sql injection. This vulnerability appears as CVE-2026-19899. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability was found in LB-LINK X-PRO 1.0.22-20231206. It has been rated as critical. The impacted element is an unknown function of the file /etc/shadow. The manipulation leads to hard-coded credentials. This vulnerability is traded as CVE-2026-19900. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability categorized as critical has been discovered in LB-LINK X-PRO 1.0.22-20231206. This affects an unknown function of the file /etc/config/easycwmp. The manipulation results in hard-coded credentials. This vulnerability is known as CVE-2026-19901. It is possible to launch the attack remotely. Furthermore, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability classified as problematic has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. This vulnerability is referenced as CVE-2026-19903. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability classified as very critical has been found in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4. This affects the function ceph_destroy_client of the component libceph. This manipulation causes use after free. This vulnerability is registered as CVE-2026-68153. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

A vulnerability classified as very critical was found in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4. This impacts the function crush_decode of the component libceph. Such manipulation leads to improper validation of array index. This vulnerability is documented as CVE-2026-68154. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4. Affected is the function ceph_monmap_decode of the component libceph. Performing a manipulation of the argument num_mon results in improper input validation. This vulnerability is reported as CVE-2026-68155. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4. Affected by this vulnerability is the function tcp_sendmsg of the component libceph. Executing a manipulation can lead to use after free. This vulnerability appears as CVE-2026-68156. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

A vulnerability has been found in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4 and classified as very critical. Affected by this issue is the function decode_new_up_state_weight of the component libceph. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-68158. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability was found in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4 and classified as very critical. This affects the function ceph_handle_caps of the component Ceph. The manipulation of the argument snap_trace_len results in out-of-bounds read. This vulnerability is known as CVE-2026-68160. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4. It has been rated as critical. Impacted is the function get_immediate_parent of the component libceph. Performing a manipulation results in null pointer dereference. This vulnerability was named CVE-2026-68157. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4. Impacted is the function hci_cmd_sync_work of the component hci_sync. This manipulation causes use after free. This vulnerability is registered as CVE-2026-68189. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

A vulnerability labeled as very critical has been found in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4. This vulnerability affects the function brcmf_pcie_release_scratchbuffers of the component brcmfmac. Executing a manipulation can lead to use after free. The identification of this vulnerability is CVE-2026-68192. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability marked as very critical has been reported in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4. This issue affects the function wilc_parse_assoc_resp_info of the component wilc1000. The manipulation leads to out-of-bounds read. This vulnerability is referenced as CVE-2026-68196. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability classified as very critical has been found in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5/7.2-rc4. The affected element is the function aggr_recv_addba_req_evt of the component ath6kl. This manipulation of the argument win_sz causes out-of-bounds read. This vulnerability is tracked as CVE-2026-68199. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability identified as very critical has been detected in Linux Kernel up to 6.6.147/6.12.100/6.18.41/7.1.5. Impacted is the function vivid_update_format_cap/vivid_update_format_out of the component vivid. The manipulation leads to improper input validation. This vulnerability is uniquely identified as CVE-2026-68204. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.