Live Threat Intelligence Radar

A vulnerability has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected by this vulnerability is the function html of the file dmAdminPlugin/web/js/dmAdminCtrl.js of the component Version Check Service. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

A flaw has been found in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. Affected is an unknown function of the file dmCorePlugin/lib/vendor/gapi/gapi.class.php of the component Google Analytics Client. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The exploit has been published and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Yamaha VOCALOID6 Editor contains a vulnerability related to improper restriction of XML external entity (XXE) references. This flaw could potentially allow an attacker to exploit XML processing to access unauthorized resources or cause other impacts. No specific affected versions or patch information are provided.

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe .

CVE-2026-112036 is a medium severity vulnerability in Artifex MuPDF up to version 1.28.5. It involves a double free flaw in the free_char_list function within the Signature Locking component. The vulnerability can be triggered remotely and may lead to memory corruption. A patch has been created to address this issue.

CVE-2026-112035 is a medium severity vulnerability in aircheng-org iWebShop-5 up to version 5.16. It affects the send_message_mobile function in controllers/simple.php, where manipulation of the user_id argument leads to weak password recovery. The vulnerability can be exploited remotely. The issue was reported early to the project but no response or fix has been provided yet. Public exploit details are available, but no known exploits in the wild have been confirmed.

An open redirect vulnerability exists in aircheng-org iWebShop-5 up to version 5.16 in the IController::redirect function within plugins/_userInfo/_userInfo.php. This flaw allows remote attackers to manipulate the callback argument to redirect users to arbitrary URLs. The vulnerability has a medium severity score of 5.3 and public exploit code is available. The vendor has not yet responded or issued a fix.

CVE-2026-112033 is a cross-site request forgery (CSRF) vulnerability in aircheng-org iWebShop-5 affecting versions 5.0 through 5.16. The flaw exists in the password change functionality within the admin_repwd and admin_repwd_act functions of controllers/system.php. This vulnerability allows remote attackers to manipulate password change requests without proper authorization. Public exploit code is available, but no official vendor response or patch has been issued as of the publication date.

CVE-2026-112032 is a medium severity SQL injection vulnerability in aircheng-org iWebShop-5 affecting versions 5.0 through 5.16. The flaw exists in the Util::search function within classes/util.php and can be exploited remotely. Public exploit code is available, but no vendor response or patch has been issued yet.