A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Executing a manipulation of the argument doc_name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-112091 is an information disclosure vulnerability in the Dav-ee dairy-management-system affecting an AJAX endpoint. The flaw involves manipulation of the 'fname' argument in the delivery/checkfarmer.json.php file, allowing remote attackers to disclose information. Exploit code has been published, but no patch or fixed version has been provided due to the product's rolling release model. The vendor has not yet responded to the issue report.
CVE-2026-112090 is a SQL injection vulnerability in the Dav-ee dairy-management-system affecting the mysqli_real_escape_string function in payment/pay.php. The vulnerability arises from manipulation of the f_no/farmer argument, allowing remote attackers to inject SQL commands. The product uses a rolling release model, so no specific affected or fixed versions are identified. Public exploit code is available, but no vendor response or patch has been issued yet. The CVSS 4.0 score rates this vulnerability as medium severity.
A security vulnerability has been detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This vulnerability affects the function mysqli_query of the file employees/delete.php. The manipulation of the argument e_payroll_no leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
A weakness has been identified in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This affects the function mysqli_query of the file farmers/add.php. Executing a manipulation of the argument f_no/f_id/f_name/f_locallity/f_ac/f_phone can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure.
CVE-2026-76740 is a high-severity OS command injection vulnerability affecting Hewlett Packard Enterprise (HPE) Compute Scale-up Server 3200 and 3250 platforms, as well as Superdome Flex and Superdome Flex 280 servers. This flaw allows remote attackers with high privileges to execute arbitrary commands on the Remote Management Controller (RMC). The vulnerability is identified as CWE-78 and has a CVSS 3.1 base score of 7.2. Multiple versions of the affected platforms prior to specific fixed releases are vulnerable.
Slims (Senayan Library Management Systems) version 9.8.0 has a cross-site request forgery (CSRF) vulnerability in its loan history maintenance feature. The vulnerability allows attackers to perform privileged, destructive actions without requiring a CSRF token or POST confirmation, potentially causing loss of loan history data.
SENAYAN Library Management System (SLiMS) Bulian version 9.8.0 contains a critical SQL Injection vulnerability in the admin reporting module. The flaw exists in the file admin/modules/reporting/customs/dl_detail.php and is exploitable via the fileID parameter. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL commands, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-107081 is a critical SQL injection vulnerability in SENAYAN Library Management System (SLiMS) Bulian version 9.8.0. The flaw exists in the admin AJAX endpoints where the tableName and tableFields POST parameters are vulnerable to identifier injection. This allows any authenticated staff user to extract arbitrary database contents, potentially compromising confidentiality, integrity, and availability of the system.
A use-after-free (UAF) vulnerability in the Linux kernel scheduler was addressed by introducing a new pointer task_struct->sched_cache_grp. This change decouples scheduler hot-path accesses from the memory management structure, fixing the UAF issue that occurred when accessing the scheduler cache group through a task whose memory management structure was being switched.
A vulnerability in the Linux kernel's pfcp subsystem was resolved involving improper socket lifetime management during netdevice registration failure. Specifically, a NULL pointer dereference could occur if the netdevice registration failed after socket creation, due to double release of the socket resource. This issue was identified through fault injection testing and results in a kernel NULL pointer dereference.
A double-free vulnerability in the Linux kernel's mtd core component related to the OTP NVMEM device has been resolved. The issue occurs if the factory OTP setup fails after the user OTP NVMEM device registration, leading to multiple unregister attempts without clearing the pointer. This flaw could cause kernel instability or crashes due to improper memory management.
A deadlock vulnerability in the Linux kernel's memory management subsystem was resolved. The issue involved the function __kfree_rcu_sheaf() waking up kswapd while holding a raw spinlock (pi_lock), which could lead to a circular locking dependency and deadlock. This deadlock was difficult to reproduce and was verified using a modified kernel with lock dependency detection. The vulnerability was fixed by ensuring kfree_rcu() does not wake up kswapd under pi_lock.
A vulnerability in the Linux kernel related to the ASoC SDCA component's power management runtime error handling in the function probe has been resolved. The fix adds a common error path to balance the runtime PM reference. No CVSS score or detailed impact information is provided.
A use-after-free vulnerability in the Linux kernel NVMe driver related to character device (cdev) lifetime management has been resolved. The issue occurs in multipath mode when the NVMe namespace head is torn down, causing open cdev file operations to reference freed memory. This can lead to kernel memory corruption and potential crashes. The vulnerability was reported by the Sashiko bot and fixed in the Linux kernel.
A vulnerability in the Linux kernel's BPF subsystem related to objects stuck in free_by_rcu_ttrace has been resolved. The issue arises because do_call_rcu_ttrace() returns early under certain conditions, leaving objects unreleased indefinitely. This can cause unbounded accumulation of such objects. The fix involves changing the state management of call_rcu_ttrace_in_progress to better track and free these objects, ensuring proper cleanup and preventing resource leakage.
A vulnerability in the Linux kernel's USB core was resolved by ensuring that both input and output endpoint pointers are cleared when disabling non-ep0 control endpoints. Previously, only one direction was cleared, potentially leaving stale pointers to disabled or freed endpoints. This fix prevents possible inconsistencies in USB endpoint management.
A vulnerability in the Linux kernel related to x86 memory management was resolved. The issue involved incorrect application of virtual address alignment (va_align) to hugetlb mappings on AMD F15h processors, causing address misalignment and kernel BUG_ON triggers during huge page teardown. This affects specific AMD processors such as Carrizo and FX-8370E. The fix involved adjusting the alignment logic to skip randomization for hugetlbfs mappings.
A vulnerability in the Linux kernel's Thunderbolt driver was resolved involving improper management of router references for allocated HopIDs. The tb_stop() function drops references to DP tunnels without deactivating them, allowing tunnels to outlive their expected lifecycle and causing operations on freed IDAs, which triggers warnings. This issue can occur when unbinding the driver while a DP tunnel is still active, notably during Apple NHI device unplug events. The fix involves holding a router reference for each allocated HopID to ensure proper lifecycle management.
A vulnerability in the Linux kernel's mac80211 Wi-Fi subsystem related to channel context management has been resolved. The issue involved premature freeing of an old channel context (chanctx) while its replacement still referenced it, potentially leading to use-after-free conditions. The fix ensures that the old chanctx remains alive until the replacement pair is fully torn down, preventing stale pointer dereferences.