A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4. The impacted element is the function getSourcePathForResize of the file modules/system/classes/ResizeImages.php. The manipulation of the argument realSourcePath results in server-side request forgery. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version 4.3.5 and 4.4.0 is sufficient to resolve this issue. The patch is identified as 0e9736aa2c6d6bd3d60ff6ef9e0b4d32ce387f58. The affected component should be upgraded.
Multiple vulnerabilities have been identified in Wi-Fi products provided by BUFFALO INC. Specific details about these vulnerabilities, including their nature, impact, and affected versions, have not been disclosed in the available information.
A vulnerability has been found in Eyeplus 57.0.0.0308. This affects an unknown function of the component p2pcam HTTP Parser. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
CVE-2026-87723 is an untrusted search path vulnerability in Google fuse-archive versions prior to 1.24. An attacker who can manipulate the PATH environment variable or place a malicious binary in a writable directory within PATH can hijack the execution flow to run arbitrary local code with the privileges of the user running fuse-archive. The vulnerability was partially mitigated in version 1.22 and fully fixed in version 1.24 by implementing refined selective PATH filtering.
CVE-2026-100907 is an information disclosure vulnerability in Eyeplus version 57.0.0.0308. It affects an unknown function within the /snapshot file of the p2pcam Service component. The flaw can be exploited remotely without authentication or user interaction. An exploit has been published, but there are no reports of active exploitation in the wild. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.9.
A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipulation results in information disclosure. The attack can be executed remotely. The exploit is now public and may be used.
A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argument itemName leads to cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-100903 is a medium severity vulnerability in ООО НПО Ритм GEOritm versions 2.45.0 and 2.45.1. It involves missing authentication in the REST API component at the /restapi/objects/obj-groups endpoint, allowing remote attackers to manipulate the objectId argument without authentication. The vendor has fixed the issue in version 2.46 and on their hosted GEO.RITM server. Users are advised to upgrade to version 2.46 to mitigate the vulnerability.
CVE-2026-100902 is a high-severity vulnerability in Barco ClickShare CX-20 Gen2 up to version 02.26.00.0007. It involves improper validation of the syntactic correctness of input in the Wallpaper Upload component, specifically in the /wallpaper file. The vulnerability can be exploited remotely without user interaction and requires low attack complexity. The vendor has not responded to the disclosure, and no patch or remediation information is currently available.
A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. Commit 6ffe823 'better security for public/stream.php' only added CURLOPT_PROTOCOLS http/https restriction and MAXREDIRS cap, does not restrict destination host. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-100900 is a server-side request forgery (SSRF) vulnerability in the DevaslanPHP project-management software affecting versions 1.2.1, 1.2.2, 1.2.3, 1.2.4, and 2.0.0-beta1. The flaw exists in the updateJiraProjects function within the /jira-import component, where manipulation of the host, username, or token parameters can lead to SSRF. The vulnerability can be exploited remotely. The vendor was notified but has not responded or provided a fix. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1. No patch or mitigation guidance is currently available from the vendor.
A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. This impacts the function whereRaw of the file app/Filament/Widgets/Timesheet/MonthlyReport.php of the component Timesheet Dashboard. Executing a manipulation of the argument filter can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the component Timesheet Dashboard. Performing a manipulation of the argument filter results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This entry is a daily update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Monday, September 28th, 2026.' It provides general information and links related to the ISC podcast and SANS classes but does not contain any specific security threat or vulnerability details.
CVE-2026-100897 is an authorization bypass vulnerability in the fuzui StudentInfo product affecting the Password Change Endpoint. The flaw involves manipulation of the sid/tid argument in the /StudentInfo/StudentHandler/moditypasswordstu file, allowing remote attackers to bypass authorization controls. The product uses a rolling release model, so specific affected versions are not available. The vendor has not responded to disclosure attempts. The CVSS 4.0 base score is 5.1, indicating a medium severity vulnerability.
A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030. The affected element is the function system of the file /boafrm/formWlSiteSurvey of the component Web Management Interface. This manipulation of the argument wlanif causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1. Impacted is the function arc_parse_canon_t in the library libopenarc/arc-canon.c of the component libopenarc. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.0.0.Beta0 is recommended to address this issue. Upgrading the affected component is advised.
CVE-2026-100894 is a medium severity SQL injection vulnerability in the mathurvishal CloudClassroom-PHP-Project affecting the updateguest.php file. The vulnerability arises from improper handling of the 'gname' argument, allowing remote attackers to inject SQL commands. The product uses a rolling release model, so specific affected versions are not clearly identified. The vendor has not responded to disclosure attempts, and no official patch or remediation guidance is available. Public exploit code exists but there is no confirmed exploitation in the wild.
A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function open_graph::fetch of the file src/api/resource.rs of the component open_graphic_parse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in aligungr UERANSIM up to 3.3.0. This affects the function ULInformationTransfer of the file src/gnb/rrc/handler.cpp of the component nr-gnb. Performing a manipulation of the argument dedicatedNASMessage results in memory corruption. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.