CWE-74
CVEs classified under CWE-74, newest first.
1317 CVEsRSS
GHSA-vwjc-v7x7-cm6gHighArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js
ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js
GHSA-pqg7-v6wh-3pfpHigh· 8.5TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services
TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services
CVE-2026-15537High· 7.3A security flaw has been discovered in SourceCodester Online Book Store System 1.0
A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file admin/login.php. The manipulation of the argument Username results in sql injection. The attack can b…
CVE-2026-15536Medium· 6.3A vulnerability was identified in itsourcecode Hospital Management System 1.0
A vulnerability was identified in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /patviewprescription.php. The manipulation of the argument delid leads to sql injection. Remote exploitation of the a…
CVE-2026-15533Medium· 4.7A security flaw has been discovered in DedeCMS 5.7.118
A security flaw has been discovered in DedeCMS 5.7.118. Impacted is an unknown function of the file /plus/search.php of the component Column Management. Performing a manipulation of the argument Column Name results in code injection. The…
CVE-2026-15523Medium· 6.3A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0
A weakness has been identified in CodeAstro Simple Online Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /SimpleOnlineLeave/admin/dashboard.php. This manipulation of the argument Name causes…
CVE-2026-15517High· 7.3A flaw has been found in Jinher OA 1.0
A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/PlanGiveOut.aspx. This manipulation of the argument httpOID causes sql injection. Remote exploitation of the att…
CVE-2026-15514High· 7.3A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06
A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCService.query of the file /customizemt/xkq/rpc.jsp of the component PHPRPC Remote Call Interface. Executing a manipula…
CVE-2026-15512Medium· 6.3A vulnerability was identified in pig-mesh Pig up to 3.9.2
A vulnerability was identified in pig-mesh Pig up to 3.9.2. Affected by this issue is some unknown functionality of the file \pig-master\pig-visual\pig-codegen\src\main\java\com\pig4cloud\pig\codegen\service\impl\GeneratorServiceImpl.jav…
CVE-2026-15502Medium· 6.3PoCA vulnerability was detected in AojiaoZero Antaris 1.0
A vulnerability was detected in AojiaoZero Antaris 1.0. This affects the function _rewardPurchase of the file /ipn.php of the component PayPal IPN Payment Handler. The manipulation of the argument item_number results in sql injection. Th…
CVE-2026-15498High· 7.3A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c
A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impacts an unknown function of the file users.php of the component Login. Such manipulation of the argument Login leads to …
CVE-2026-15497High· 7.3A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2
A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file sonic-server-controller/src/main/java/org/cloud/sonic/controller/controller/ExchangeController.java of the component JW…
CVE-2026-15494Medium· 4.7A flaw has been found in AMTT Hotel Broadband Operation System 1.0
A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch_status.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to l…
CVE-2026-15490High· 7.3A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99
A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this issue is some unknown functionality of the file proses/add.php. The manipulation of the argument kode_produk…
CVE-2026-15489High· 7.3A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99
A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by this vulnerability is an unknown functionality of the file proses/login.php. The manipulation of the argument Username…
CVE-2026-15482High· 7.3A weakness has been identified in Aster Telecom Azcall 10/11
A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown processing of the file /azcall/adm/gestao_loja/sis.php?t=consultar of the component HTTP Handler. Executing a manipulation of the argument nome…
CVE-2026-15481High· 8.8A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03
A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_test of the file /sbin/rc of the component IPoA WAN Connection Setup. Performing a manipulation of the argument ipoa_i…
CVE-2026-15478Medium· 6.3A flaw has been found in IceHRM up to 35.0.1
A flaw has been found in IceHRM up to 35.0.1. This impacts an unknown function of the file core/src/Reports/User/Reports/EmployeeAttendanceReport.php of the component UserReport Endpoint. Executing a manipulation of the argument employee…
CVE-2026-15477Medium· 6.3A vulnerability was detected in Bahmni bahmnicore up to 0.93
A vulnerability was detected in Bahmni bahmnicore up to 0.93. This affects the function additionalParams of the file /openmrs/ws/rest/v1/bahmnicore/sql of the component Search Endpoint. Performing a manipulation of the argument test resu…
CVE-2026-54159Critical· 10.0prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
prestashop/ps_facetedsearch: PHP Object Injection in faceted search cache allows unauthenticated RCE
CVE-2026-0284Critical· 9.9⚖ disputedAn XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to informatio…
An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to informatio…
CVE-2026-58213High· 7.1NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system
NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.1 and 2.12.9, an MQTT client could include protocol control characters in subscription filters that were later forwarded as N…
CVE-2026-55427High· 8.3Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
Coder vulnerable to SSH config injection via unsanitized server-supplied values in `coder config-ssh`
CVE-2026-55615CriticalLangroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879
CVE-2026-54771High· 8.1Langroid: handle_message() executes user-supplied tool JSON without sender verification
Langroid: handle_message() executes user-supplied tool JSON without sender verification
CVE-2026-14619Medium· 6.3A flaw has been found in itsourcecode Hospital Management System 1.0
A flaw has been found in itsourcecode Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file /medicine.php. This manipulation of the argument editid causes sql injection. Remote exploitation of t…
CVE-2026-53488High· 8.8github.com/containerd/containerd: containerd: Host-root command execution via unvalidated image config labels in CRI plugin (CVE-2026-53488)
A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface (CRI) plugin, which manages container operations, fails to validate labels propagated from an image configuration to a container. This oversi…
CVE-2026-13542Medium· 6.3A security vulnerability has been detected in itsourcecode Hospital Management System 1.0
A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /doctorprofile.php. The manipulation of the argument doctorname leads to sql injection. It is possible…
CVE-2026-13541Medium· 6.3A weakness has been identified in itsourcecode Hospital Management System 1.0
A weakness has been identified in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /doctorchangepassword.php. Executing a manipulation of the argument newpassword can lead to sql injection. The at…
CVE-2026-13538Medium· 6.3A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425
A vulnerability was determined in Wavlink WL-NU516U1-A M16U1_V240425. The affected element is the function sub_401D68 of the file /cgi-bin/wireless.cgi of the component POST Parameter Handler. This manipulation of the argument SSID2G2/SS…