Adobe Campaign Classic contains an Incorrect Authorization vulnerability (CWE-863) that allows a low-privileged attacker to execute arbitrary code with the privileges of the current user. This vulnerability does not require user interaction and changes the security scope, making it critical.
Adobe Campaign Classic contains an SQL Injection vulnerability (CWE-89) that allows a low-privileged attacker to execute arbitrary code without user interaction. The vulnerability affects version 0 of the product and has a critical severity with a CVSS score of 9.9. Exploitation changes the security scope and can lead to full compromise of confidentiality, integrity, and availability in the context of the current user.
Adobe Campaign Classic contains a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2026-104350) that allows attackers to inject malicious scripts via crafted URLs or compromised web pages. Successful exploitation requires user interaction and can lead to elevated access or control over the victim's account or session. The vulnerability has a critical severity rating with a CVSS score of 9.3.
Adobe Campaign Classic (ACC) suffers from a critical SQL Injection vulnerability (CWE-89) that allows an attacker to execute arbitrary SQL commands without user interaction. This flaw could lead to arbitrary code execution within the context of the current user, potentially enabling elevated access or control over the victim's account or session. The vulnerability affects version 0 of the product and has a CVSS 3.1 base score of 10.0, indicating maximum severity.
Adobe Campaign Classic contains a critical code injection vulnerability (CWE-94) that allows a low-privileged attacker to execute arbitrary code without user interaction. This vulnerability changes the security scope and could lead to full compromise of the affected system under the context of the current user.
Adobe Campaign Classic contains an SQL Injection vulnerability that allows an attacker with high privileges to execute arbitrary code without user interaction. This vulnerability affects version 0 of the product and can lead to a complete compromise of confidentiality, integrity, and availability. The vulnerability changes the security scope, increasing its impact.
Adobe Campaign Classic contains an SQL Injection vulnerability that allows a low-privileged attacker to bypass security features and gain unauthorized read and limited write access without user interaction. The vulnerability changes the security scope and has a critical severity rating.
CVE-2026-117514 is a SQL injection vulnerability in the oretnom23 php-travel-agency-system affecting the admin/customer_detail.php file. The flaw arises from improper handling of parameters such as costomer_id, ticket_id, emp_id, salary_id, and page_id, allowing remote attackers to inject SQL commands. Exploit code is publicly available, but no official response or patch has been issued by the vendor.
CVE-2026-57189 is an out-of-bounds write vulnerability in the Asterisk telephony toolkit affecting the chan_sip channel driver when its textsupport option is enabled. An authenticated attacker can trigger a T.140 RED out-of-bounds write during generation accumulation, potentially leading to remote code execution or a crash. The chan_sip driver is deprecated in Asterisk 20 and removed in later versions. Fixes are available in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and corresponding certified releases.
CVE-2026-57201 is a high-severity stack buffer overflow vulnerability in the Asterisk telephony toolkit's H.323 chan_ooh323 addon channel driver. It arises from an unbounded vsprintf write into a fixed 2048-byte buffer in the ooTrace() trace-logging function. This can cause the Asterisk process to crash when processing a crafted packet. The vulnerable chan_ooh323 driver is not enabled by default and requires explicit compilation and a publicly reachable port. The issue is fixed in multiple Asterisk releases including 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk versions 20.7-cert11 and 22.8-cert3.
CVE-2026-114598 is a high-severity vulnerability in EPICS Base versions up to and including 7.0.10. It involves insufficient validation of element or length values in network messages, which can cause the application to read beyond allocated buffer bounds. This flaw can lead to denial of service and potential exposure of adjacent memory contents.
Private keys for eight eMudhra intermediate CA certificates have been compromised https://emudhra.we-have-a-problem.com/ , which impacts certificate trust for outbound network request features of HCL Notes Client. An unauthenticated network attacker could spoof server certificates to execute a man in the middle (MITM) attack, enabling them to intercept and/or modify the content of outbound TLS connections.
CVE-2026-57194 is an out-of-bounds write vulnerability in the chan_unistim module of Asterisk, an open source telephony toolkit. The flaw allows an attacker to overflow the phone_number field and crash the system by sending a crafted incoming request packet. Exploitation requires the chan_unistim module to be loaded and configured with a reachable UNISTIM UDP port, and the attacker must register as a configured phone MAC or use an equivalent provisioning path. This vulnerability affects multiple Asterisk versions prior to fixed releases and has a medium severity rating with a CVSS score of 5.9.
CVE-2026-114597 affects EPICS Base versions up to and including 7.0.10. It involves improper validation of element or length values in network messages, which can cause the application to read beyond allocated buffer boundaries. This vulnerability may lead to denial of service and potential exposure of adjacent memory contents.
CVE-2026-114596 is a high-severity integer overflow vulnerability in EPICS Base versions up to and including 7.0.10. The flaw arises from improper validation of message length values during protocol parsing, which can lead to an integer overflow and subsequent out-of-bounds memory write. Exploitation may cause process instability or denial of service conditions.
The numprint package on PyPI version 1.2.0 contains malicious code that executes during installation. It starts a background process that runs commands from an attacker via communication through a GitHub Gist. This behavior indicates the package is used as a remote access trojan (RAT) to execute attacker-provided commands on the victim's machine.
CVE-2026-114595 is a critical integer overflow vulnerability in EPICS Base versions up to 7.0.10. The flaw occurs during network request processing, causing memory to be allocated with an incorrect size. This can lead to memory corruption, denial of service, or potentially remote code execution if attacker-supplied data is handled improperly.
CVE-2026-57198 is a heap-based buffer overflow vulnerability in the Asterisk telephony toolkit affecting the chan_sip channel driver when the textsupport option is enabled. An authenticated attacker can exploit this flaw by sending crafted T.140 RED packets, potentially causing remote code execution or crashing the system. The chan_sip driver is deprecated in Asterisk 20 and removed in later versions. Fixes are available in multiple Asterisk versions including 20.20.1, 21.12.3, 22.10.1, and 23.4.1.
TinyMCE versions from 7.9.3 up to but not including 7.9.4, and from 8.5.1 up to but not including 8.9.3, contain a stored cross-site scripting (XSS) vulnerability in the media plugin. This occurs because the plugin creates elements using data-mce-object in the active document before sanitization, allowing malicious scripts to execute during processing. The vulnerability is fixed in versions 7.9.4 and 8.9.3.
CVE-2026-117513 is a SQL injection vulnerability in the oretnom23 php-travel-agency-system affecting the admin/customer_search.php component. It allows remote attackers to manipulate the customer_name, voucher_no, or emp_name parameters to execute SQL injection attacks. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.