A security vulnerability has been detected in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. This affects an unknown part of the file /Admin/includes/AddNewPlan-inc.php of the component Plan Management Form. The manipulation of the argument submit/Plan_no/Name leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/includes/Admin-Register-inc.php of the component Add New Admin Form. Executing a manipulation of the argument submit/Admin_id/password can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
A SQL injection vulnerability exists in the dhikshitha29 Insurance-Management-System within the mysqli_query function of /Agent/ManagePolicy/EditPolicyHolder.php. The flaw allows remote attackers to manipulate the Policy_no or Name parameters to execute unauthorized SQL commands. Public exploit code is available. The product uses a rolling release model, so specific affected versions are not provided.
CVE-2026-114242 is a SQL injection vulnerability in the dhikshitha29 Insurance-Management-System affecting the mysqli_query function in /Admin/View/editPlan.php. The vulnerability arises from manipulation of the Plan_no or Name parameters, allowing remote attackers to execute SQL injection attacks. The product uses a rolling release model, so specific affected or fixed versions are not available. The vulnerability has a medium severity score of 6.9 and public exploit code is available. The vendor has been informed but has not yet responded or issued a fix.
The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root.
Security Fix(es):
* sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization (CVE-2026-96512)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:
* Certificate Authority (CA)
* Key Recovery Authority (KRA)
* Online Certificate Status Protocol (OCSP) Manager
* Token Key Service (TKS)
* Token Processing Service (TPS)
* Automatic Certificate Management Environment (ACME) Responder
* Enrollment over Secure Transport (EST) Responder
Security Fix(es):
* pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint) (CVE-2026-76561)
* pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint (CVE-2026-80110)
* com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing (CVE-2026-68497)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.
CVE-2026-113744 is a critical stack-based buffer overflow vulnerability in the Tenda AC19 router firmware version 16.03.10.07. The flaw exists in the formSetFirewallCfg function of the httpd Web Management Service, triggered by manipulation of the firewallEn argument. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed.
Trigger.dev versions prior to 4.6.0 have an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint. This flaw allows users with restricted read:envvars permissions to access the environment's root API key (TRIGGER_SECRET_KEY) for staging, production, and preview environments. Exploiting this, attackers can retrieve plaintext secrets, trigger tasks, and mint admin-level public JWTs. The vulnerability is fixed in version 4.6.0.
CVE-2026-93441 is a high-severity vulnerability in IBM QRadar Security Information and Event Management (SIEM) that allows a remote attacker to cause a denial of service by triggering uncontrolled resource consumption. This flaw affects specific versions of QRadar from 7.4 through 7.6. The vulnerability does not impact confidentiality or integrity but can severely disrupt availability.
CVE-2026-91629 is a vulnerability in Oracle Communications Billing and Revenue Management (BRM) platform versions 15.0.0.0.0 through 15.2.0.0.0. It allows a low privileged attacker with logon access to the infrastructure to potentially compromise the BRM system. The vulnerability is difficult to exploit and primarily impacts confidentiality, enabling unauthorized access to critical or all accessible data within the BRM environment. The CVSS 3.1 base score is 4.7, indicating a medium severity level.
CVE-2026-91628 is a vulnerability in Oracle Communications Billing and Revenue Management (BRM) versions 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0, and 15.2.0.0.0. It allows a low privileged attacker with logon access to the infrastructure to compromise the BRM system, potentially gaining unauthorized access to critical data. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity with a high confidentiality impact but no impact on integrity or availability. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains multiple patches across various products, including BRM.
CVE-2026-91627 is a vulnerability in Oracle Communications Billing and Revenue Management (BRM) versions 15.0.0.0.0 through 15.2.0.0.0. It allows a low-privileged attacker with logon access to the infrastructure to compromise the BRM system. The vulnerability has a high severity with a CVSS 3.1 base score of 7.8, impacting confidentiality, integrity, and availability. Successful exploitation can lead to full takeover of the affected product.
CVE-2026-91625 is a high-severity vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized updates, inserts, or deletes on accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, indicating significant confidentiality and integrity impacts. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory, which contains numerous security patches across multiple products.
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized access to critical data or complete access to all Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2026-91623 is a vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to potentially create, delete, or modify critical data or gain unauthorized access to all accessible data within the product. The vulnerability is rated with a CVSS 3.1 base score of 7.4, indicating high severity with impacts on confidentiality and integrity. The vulnerability is difficult to exploit due to high attack complexity and requires no user interaction. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory.
CVE-2026-91622 is a critical vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4. It allows an unauthenticated attacker with network access via HTTP to compromise the product by exploiting a flaw that requires user interaction. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as complete unauthorized access to all data accessible by the product. The vulnerability has a CVSS 3.1 base score of 9.3, indicating high confidentiality and integrity impact. Oracle has included this vulnerability in its October 2026 Critical Patch Update advisory but has not explicitly listed a patch for this specific version in the provided advisory content.