A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5. Affected by this vulnerability is an unknown functionality of the file chat.php. Executing a manipulation of the argument ID can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-116639 is a cross-site scripting (XSS) vulnerability in the MD-MAFUJUL-HASAN Online-Payroll-Management-System affecting an unknown function in chat.php. The vulnerability arises from manipulation of the 'ID' argument and can be exploited remotely. The product uses a rolling release model, so no specific affected or fixed versions are available. The issue was reported early to the project, but no response or fix has been provided yet. Public exploit code is available. The CVSS 4.0 score is 5.1, indicating medium severity.
CVE-2026-116623 is a vulnerability in code-projects Simple Content Management System version 1.0. It involves missing authorization in the admin interface component, specifically in the /web/admin/welcome.php file. The flaw arises from manipulation of the 'addnews' argument, allowing remote attackers to exploit the system without proper authorization. Public exploit code is available. The vulnerability has a medium severity rating with a CVSS score of 6.9.
Kener versions from 3.0.0 up to but not including 4.1.10 have an authentication bypass vulnerability. This flaw allows unauthenticated attackers to forge session tokens by exploiting a hardcoded fallback key (DUMMY_SECRET) used when the KENER_SECRET_KEY is unset or empty. Attackers who know an administrator's email can sign a user cookie to gain full administrative access to the management API or forge password-reset tokens.
CVE-2026-106296 is a vulnerability in Chromium involving improper privilege management in the user interface. It affects versions prior to 155.0.4283.48. A fix is available in version 155.0.4283.48.
OpenPanel versions before 3.0.0 have an authorization vulnerability in the onboarding.project tRPC mutation. This flaw allows non-admin organization members to create projects and generate write-type ingestion credentials, bypassing intended admin-only restrictions. Exploitation can lead to exposure of plaintext secrets, injection of fake analytics events, distortion of business metrics, and unauthorized consumption of the organization's usage budget. The vulnerability has a medium severity score of 5.3 and is fixed in OpenPanel version 3.0.0.
An authorization issue in Apple iOS and iPadOS was addressed by improving state management. The vulnerability could allow an app to fingerprint the user. The issue is fixed in iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, and iPadOS 27.2.
A use-after-free vulnerability in Safari and related Apple operating systems was addressed through improved memory management. This flaw could cause Safari to crash when processing maliciously crafted web content. The issue is fixed in Safari 27.2, iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, and visionOS 27.2.
An authorization issue in Apple operating systems was addressed by improving state management. This vulnerability could allow an app to access sensitive user data. The issue is fixed in iOS 27.2, iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2.
A logic issue in macOS Gatekeeper was addressed by improving state management. This flaw could allow an app to bypass Gatekeeper checks. The issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
CVE-2026-86946 is a use-after-free vulnerability in macOS that could allow an application to cause unexpected system termination or corrupt kernel memory. The issue has been addressed with improved memory management and fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
A privacy issue in macOS was addressed through improved memory management. The vulnerability could allow an application to access sensitive user data. The issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
An authorization issue affecting multiple Apple operating systems was addressed through improved state management. The flaw could allow an app to access sensitive user data. This vulnerability is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, and visionOS 27.
CVE-2026-86916 is a use-after-free vulnerability affecting Apple operating systems including iOS, iPadOS, and macOS. The flaw allows an application to potentially execute arbitrary code with kernel privileges. This vulnerability has been addressed by improved memory management and fixed in specific versions of these OSes.
A use after free vulnerability in macOS was addressed by improved memory management. The flaw could allow an app with App Sandbox restrictions to escape the sandbox and execute code with root privileges. The issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2.
A logic issue affecting iOS and iPadOS was addressed by improved state management. The vulnerability could allow an app to access sensitive user data. The issue is fixed in iOS 26.7.2, iPadOS 26.7.2, and all versions of iOS 27 and iPadOS 27.
A use-after-free vulnerability was addressed through improved memory management in multiple Apple operating systems. This flaw could allow an application to cause unexpected system termination or write to kernel memory. The issue is fixed in iOS 26.7.2 and 27.2, iPadOS 26.7.2 and 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2.
An authorization vulnerability in iOS and iPadOS was addressed by improving state management. The flaw could allow an app to read the device's name without proper authorization. This issue is fixed in iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, and iPadOS 27.2.
An authorization vulnerability in macOS was addressed by improving state management. The flaw could have allowed an application to access sensitive user data. The issue is fixed in macOS Golden Gate 27 and macOS Tahoe 26.7.2.
An authorization issue in Apple operating systems was addressed by improving state management. The flaw could allow an app to access sensitive user data. The issue is fixed in multiple versions of iOS, iPadOS, macOS, and visionOS.