CVE-2026-108777 is a SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting the WvGiController.list function. The vulnerability arises from unsafe manipulation of the 'searchstr' argument, allowing remote attackers to execute SQL injection attacks. The affected version is 2026.09.27-W39. The vulnerability has a medium severity with a CVSS 4.0 score of 5.3. Exploit code has been publicly disclosed, but no vendor response or patch is currently available.
CVE-2026-108775 is a medium severity SQL injection vulnerability in erzhongxmu JEEWMS version 2026.09.27-W39. The flaw exists in the WvNoticeController.list function within the Search Endpoint component, where the searchstr argument is improperly handled, allowing remote attackers to execute SQL injection attacks. The vulnerability has been publicly disclosed, and no vendor response or patch is currently available.
CVE-2026-108774 is a medium severity SQL injection vulnerability in erzhongxmu JEEWMS version 2026.09.27-W39. The flaw exists in the getbinall/getbinallagv functions of MdBinController.java, where manipulation of certain input parameters can lead to SQL injection. The vulnerability can be exploited remotely and exploit code has been published. The vendor has not responded to disclosure and no patch or fix information is available.
CVE-2026-108773 is a medium severity SQL injection vulnerability in the erzhongxmu JEEWMS product, specifically affecting version 2026.09.27-W39. The flaw exists in the docheck function of the WmOmNoticeHController.java file, where manipulation of the goodscode argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction and requires low privileges. The vendor has not responded to disclosure requests, and no patch or official fix is currently documented. Public exploit code is available, increasing the risk of exploitation.
CVE-2026-108772 is a path traversal vulnerability in bleenco abstruse affecting versions 2.0 and 2.1.0. The flaw exists in the filepath.Join function within the file server/api/worker/download_cache.go component, specifically in the Cache Endpoint. This vulnerability allows remote attackers to manipulate file path arguments to access unauthorized files. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity). The exploit has been publicly disclosed, but no known exploits are currently observed in the wild. The vendor has not responded to the disclosure, and no patch or remediation information is available.
CVE-2026-108770 is a server-side request forgery (SSRF) vulnerability in Appwrite versions 2.0 through 2.3.0. It affects the PublicHostname function in the Browser Screenshot Service component, allowing remote attackers to manipulate the url argument. The issue is resolved by upgrading to version 2.4.0.
CVE-2026-108769 is a denial of service vulnerability in zhayujie CowAgent affecting versions 2.0, 2.1, and 2.2.0. The flaw exists in the Markdown.tsx file of the Markdown Rendering component and can be exploited remotely without user interaction. Public exploit code is available, but no vendor response or patch has been provided.
Multiple security vulnerabilities have been identified in the xorg-x11-server-Xwayland component used in Red Hat Enterprise Linux 8. These include several arbitrary code execution flaws, privilege escalation, use-after-free, double-free, out-of-bounds write, and heap-based buffer overflow issues. The vulnerabilities affect various versions of the xorg-x11-server-Xwayland package. Red Hat has released security updates addressing these issues.
A heap-based buffer overflow vulnerability exists in Samsung Opensource rlottie, triggered via environment variables. This flaw can cause a denial of service by crashing the affected application. No confidentiality or integrity impacts are reported. The vulnerability has a medium severity score of 5.5 CVSS v3.1. No affected versions or patches are explicitly stated.
Yandex data centres in Russia were targeted and damaged by drone strikes amid ongoing conflict dynamics following an announced energy ceasefire by Donald Trump. The attacks caused significant service disruptions, including shutdowns of key data centres housing AI supercomputers and impacting multiple consumer and business services. Traffic from Yandex's network dropped sharply, indicating a severe operational impact. Yandex has not provided a timeline for restoration of affected services.
GNU Emacs versions before 31.2, including TRAMP through 2.8.2, contain a vulnerability that allows OS command injection via crafted filenames. This occurs because the tramp-user-regexp filter has an incomplete list of disallowed inputs, resulting from an incomplete fix for a previous vulnerability (CVE-2026-79992). The vulnerability has a high severity rating with a CVSS score of 7.8.
CVE-2026-108963 is a high-severity vulnerability in databasement before version 1.8.2 that allows authenticated users to perform remote code execution. The issue arises because databasement runs commands like mariadb-dump with a database name argument that can be controlled by any authenticated user. This argument injection can lead to indirect code execution, such as writing files to arbitrary locations like /app/public/index.php. The vulnerability is due to improper neutralization of argument delimiters (CWE-88).
CVE-2026-108768 is a medium severity vulnerability in zhayujie CowAgent up to version 2.2.0. It involves the json.loads function in the Streaming Tool-Call Argument Handler component, where remote manipulation can lead to resource allocation issues. The vulnerability can be exploited remotely, and public exploit code is available. The vendor has not responded to disclosure attempts, and no patch or remediation information is currently available.
Omarchy 4 versions prior to 4.0.1 contain a vulnerability in the omarchy-theme-set component that allows code execution via third-party themes. This occurs because files placed into the ~/.local/state/omarchy/current/theme directory may include executable content sourced from an untrusted Git repository. The vulnerability has a high severity score of 7.1 CVSS 3.1.
CVE-2026-108925 is a medium severity vulnerability involving improper neutralization of script-related HTML tags (basic cross-site scripting) in the Cohesity NetBackup Administration Console web interface. It affects versions prior to 11.2. The vulnerability allows an attacker to inject script code that could be executed in the context of the affected web interface. No known exploits are reported in the wild. No explicit patch or remediation details are provided in the available data.
CVE-2026-59508 is an SQL injection vulnerability in Interuse i-Bos version 3.0. It involves improper neutralization of special elements in SQL commands, which could allow an attacker to manipulate database queries. The vulnerability has a CVSS 3.1 base score of 5.9, indicating medium severity. There is no indication of known exploits in the wild or available patches at this time.
CVE-2026-19740 is a denial-of-service vulnerability in the Zephyr Bluetooth LE Controller's Link Layer Control Procedure (LLCP) implementation. A crafted sequence of Bluetooth LE control PDUs can cause the controller to leak receive nodes or trigger an assertion failure, exhausting the receive pool and rendering Bluetooth inoperable until reboot. The issue affects Zephyr versions from 3.4.0 up to but not including 4.5.0. The vulnerability does not lead to memory corruption or information disclosure, only availability impact.
CVE-2026-19739 is a denial of service vulnerability in the Zephyr Bluetooth Link Layer controller affecting versions from 3.4.0 up to but not including 4.5.0. The flaw involves improper handling of retained RX nodes during Connection Update or Connection Parameter procedures, which can lead to either a fatal controller error or exhaustion of the controller's RX buffer pool. This vulnerability can be triggered remotely by a peer device without requiring pairing, bonding, or encryption, causing persistent denial of service until the device is rebooted. There is no memory corruption or information disclosure associated with this issue.
CVE-2026-19738 is a denial-of-service vulnerability in the Zephyr project's Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation. The flaw causes memory nodes to be orphaned and not released when invalid PDUs are received, leading to resource exhaustion. An attacker within radio range can trigger this without authentication or encryption by sending crafted LL Control PDUs. The impact is limited to availability, causing system resets or stalled flow control requiring a reboot to recover.