A weakness in the Global Session Handler component of mathurvishal CloudClassroom-PHP-Project allows remote attackers to cause session expiration through manipulation. The attack requires high complexity and is difficult to exploit. No specific affected versions or patches are available due to the product's rolling release model. The vendor did not respond to disclosure attempts. The CVSS score is low (3.7) with limited impact to confidentiality only.
VStarcam O-KAM SuperIPCam version 1.3.3.32 contains a use-after-free vulnerability in the P2P Session Teardown component. This flaw affects the function FUN_005a2d44 in the SuperIPCam.exe file and can be exploited remotely without authentication. The vulnerability has a CVSS score of 7.3, indicating high severity. Public exploit code is available, but the vendor has not responded or issued a patch.
A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project in an unknown function within the file viewquery.php. The vulnerability is triggered by manipulation of the 'eid' argument and can be exploited remotely. Public exploit code is available. The product uses a rolling release model, so specific affected or fixed versions are not provided. The vendor has not responded to disclosure attempts.
A critical vulnerability (CVE-2026-120344) exists in WAVLINK WN551X3-A firmware version M51X3_V251020-WO-182e965. The flaw is an OS command injection in the WireGuard CLI Group Handler component, specifically in the /bin/ioos file's system function when processing the group_name argument. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. No patch or remediation information is currently available.
VStarcam O-KAM Client version 1.3.3.32 contains a stack-based buffer overflow vulnerability in the function FUN_10003EA0 within the DevDll_925.dll library. This vulnerability can be exploited remotely without authentication and has a high severity rating. Public exploit code is available. The vendor has not responded to disclosure attempts and no patch information is provided.
A cross-site scripting (XSS) vulnerability exists in the mathurvishal CloudClassroom-PHP-Project within the updatedetailsfromfaculty.php file. The flaw is triggered by manipulation of the fname argument and can be exploited remotely. The vendor has not provided a response or patch, and no specific affected versions are identified due to the project's rolling release model. Public exploit code is available. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-101175 is a null pointer dereference vulnerability in the ArkWeb module of Huawei HarmonyOS versions 6.1.0 and 7.0.0. Exploitation may lead to a denial of service condition affecting system availability. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploits or patches are currently documented.
CVE-2026-101171 is a permission control vulnerability in the background task management module of Huawei HarmonyOS versions 6.1.0 and 7.0.0. Exploiting this flaw may impact service integrity by allowing unauthorized actions within the system. The vulnerability has a low CVSS score of 3.6, indicating limited severity and requiring user interaction for exploitation. No public exploits or known active exploitation have been reported. No patch information is provided, so the remediation status is unclear.
CVE-2026-101170 is a denial-of-service (DoS) vulnerability in the file parsing module of Huawei HarmonyOS version 7.0.0. Exploiting this flaw may impact system availability but does not affect confidentiality or integrity. The vulnerability is related to a misinterpretation of input (CWE-115).
CVE-2026-101172 is a permission control vulnerability in the graphics module of Huawei HarmonyOS version 7.0.0. Exploiting this flaw could lead to unauthorized access affecting confidentiality. The vulnerability has a medium severity rating with a CVSS score of 6.2. No public exploits or patches are currently documented.
CVE-2026-111497 is a vulnerability in the Google Brotli decoder used by Red Hat OpenShift AI and other Red Hat products. It involves an out-of-bounds write triggered by a crafted Brotli-compressed stream, potentially leading to memory disclosure, denial of service, or arbitrary code execution when decompressing untrusted Brotli data. Exploitation requires a malformed Brotli stream and is rated as having high attack complexity. Red Hat platform hardenings reduce the likelihood of reliable code execution but do not eliminate crashes or all impacts. The issue affects Brotli decoders used in various Node.js and .NET versions bundled or system-wide in Red Hat Enterprise Linux. Red Hat has released updated images for Red Hat OpenShift AI 3.4.6 and advises following upgrade documentation to apply the errata update.
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Multiple security vulnerabilities have been identified in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include denial of service conditions via crafted commands and out-of-bounds reads, as well as remote code execution through heap buffer overflows and uninitialized heap memory disclosure. The vulnerabilities affect the xfreerdp client and related components. Red Hat has issued an important security advisory providing updates for affected Red Hat Enterprise Linux 8.6 variants to address these issues.
The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account.
This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.
CVE-2025-11969 is an improper authorization vulnerability in WSO2 Identity Server as Key Manager. The System REST APIs fail to enforce correct access control, allowing users with lower privilege roles to perform unauthorized administrative actions. This vulnerability does not affect APIs exposed through the WSO2 API Manager's API Gateway. The issue has been fixed in multiple versions starting from 3.1.0.347 and later.
CVE-2026-120348 is a code injection vulnerability in dayrui XunRuiCMS versions 4.7.0 through 4.7.4. It affects the _get_tpl_content function in the Email Template Rendering component, allowing remote attackers to inject code. Public exploit code exists, but no vendor response or patch has been provided.
A security vulnerability (CVE-2026-103484) in the pgvector extension of PostgreSQL allows arbitrary code execution via an out-of-bounds write during the IVFFlat index build process. This issue affects PostgreSQL 16 as packaged for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat has issued an important security update to address this flaw.
CVE-2026-120347 is a SQL injection vulnerability in dayrui XunRuiCMS versions 4.7.0 through 4.7.4. The flaw exists in the View function of the Member Module component, specifically in the file dayrui/Fcms/Core/View.php. An attacker can remotely manipulate the 'catid' argument to execute SQL injection. Public exploit code has been disclosed. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9.