CVE-2026-45200 - GPU DDK - Double free in _FreeOSPages due to incorrect allocation flag set by _EncodeAllocationFlags
CVE ID :CVE-2026-45200
Published : Sept. 4, 2026, 2:17 a.m. | 2 hours, 2 minutes ago
Description :Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that would cause an incorrect double free event when freed.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-45200
Published : Sept. 4, 2026, 2:17 a.m. | 2 hours, 2 minutes ago
Description :Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that would cause an incorrect double free event when freed.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85382 - light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting
CVE ID :CVE-2026-85382
Published : Sept. 4, 2026, 2:17 a.m. | 2 hours, 2 minutes ago
Description :A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialchars_decode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a manipulation of the argument content results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85382
Published : Sept. 4, 2026, 2:17 a.m. | 2 hours, 2 minutes ago
Description :A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Impacted is the function htmlspecialchars_decode of the file App/Home/View/Default/Chapter/oneChapter.tpl of the component Chapter Content Output. Performing a manipulation of the argument content results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85383 - itsourcecode Sales and Inventory System inv_del.php sql injection
CVE ID :CVE-2026-85383
Published : Sept. 4, 2026, 2:17 a.m. | 2 hours, 2 minutes ago
Description :A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85383
Published : Sept. 4, 2026, 2:17 a.m. | 2 hours, 2 minutes ago
Description :A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85397 - code-projects Hospital Information System addReq.php findBySearch sql injection
CVE ID :CVE-2026-85397
Published : Sept. 4, 2026, 2:17 a.m. | 2 hours, 2 minutes ago
Description :A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85397
Published : Sept. 4, 2026, 2:17 a.m. | 2 hours, 2 minutes ago
Description :A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85403 - code-projects Doctor Appointment System contactus.php sql injection
CVE ID :CVE-2026-85403
Published : Sept. 4, 2026, 3:15 a.m. | 1 hour, 4 minutes ago
Description :A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation of the argument firstname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85403
Published : Sept. 4, 2026, 3:15 a.m. | 1 hour, 4 minutes ago
Description :A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation of the argument firstname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-75754 - ASUS Control Center Authentication Bypass, SSRF, and Hard-coded Credentials Vulnerability
CVE ID :CVE-2026-75754
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with the hardcode credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company. Refer to the 'Security Update for ASUS Control Center' section on the ASUS Security Advisory for more information.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-75754
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with the hardcode credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company. Refer to the 'Security Update for ASUS Control Center' section on the ASUS Security Advisory for more information.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85146 - Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials
CVE ID :CVE-2026-85146
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85146
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85147 - Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials
CVE ID :CVE-2026-85147
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85147
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85148 - Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials
CVE ID :CVE-2026-85148
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85148
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85149 - Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials
CVE ID :CVE-2026-85149
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85149
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the file system of the user's host.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85398 - code-projects Hospital Information System viewReq.php viewReq sql injection
CVE ID :CVE-2026-85398
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85398
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85399 - code-projects Hospital Information System PrespController.php getSinglePresp sql injection
CVE ID :CVE-2026-85399
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file includes/presp/PrespController.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85399
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :A security flaw has been discovered in code-projects Hospital Information System 1.0. Affected by this vulnerability is the function getSinglePresp of the file includes/presp/PrespController.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85401 - Dolibarr Legacy File Manager config.inc.php access control
CVE ID :CVE-2026-85401
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85401
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :A weakness has been identified in Dolibarr up to 21.0.4/22.0.5/23.0.3. Affected by this issue is some unknown functionality of the file htdocs/core/filemanagerdol/connectors/php/config.inc.php of the component Legacy File Manager. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 23.0.4 can resolve this issue. This patch is called ef6631e9bd5ec4b8cec0e88f1796d3d10dad02ec. It is suggested to upgrade the affected component.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85402 - code-projects Doctor Appointment System booking.php sql injection
CVE ID :CVE-2026-85402
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85402
Published : Sept. 4, 2026, 3:17 a.m. | 1 hour, 1 minute ago
Description :A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85405 - Eleveo Call Recording Software roleAddAction.do cross site scripting
CVE ID :CVE-2026-85405
Published : Sept. 4, 2026, 3:30 a.m. | 49 minutes ago
Description :A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85405
Published : Sept. 4, 2026, 3:30 a.m. | 49 minutes ago
Description :A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/roleAddAction.do. Executing a manipulation of the argument name/username can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-85406 - Eleveo Quality Management Conversation Review cross site scripting
CVE ID :CVE-2026-85406
Published : Sept. 4, 2026, 3:45 a.m. | 34 minutes ago
Description :A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the component Conversation Review. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-85406
Published : Sept. 4, 2026, 3:45 a.m. | 34 minutes ago
Description :A vulnerability has been found in Eleveo Quality Management 9.7.0. This vulnerability affects unknown code of the component Conversation Review. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-17517 - Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter
CVE ID :CVE-2026-17517
Published : Sept. 4, 2026, 7:17 a.m. | 1 hour, 2 minutes ago
Description :The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-17517
Published : Sept. 4, 2026, 7:17 a.m. | 1 hour, 2 minutes ago
Description :The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-19224 - Hummingbird < 3.21.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
CVE ID :CVE-2026-19224
Published : Sept. 4, 2026, 7:17 a.m. | 1 hour, 2 minutes ago
Description :The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-19224
Published : Sept. 4, 2026, 7:17 a.m. | 1 hour, 2 minutes ago
Description :The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-62928 - XING CPTrans-ME-X OS Command Injection Vulnerability
CVE ID :CVE-2026-62928
Published : Sept. 4, 2026, 7:17 a.m. | 1 hour, 2 minutes ago
Description :XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-62928
Published : Sept. 4, 2026, 7:17 a.m. | 1 hour, 2 minutes ago
Description :XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-66840 - XING CPTrans-ME-X Exposure of Sensitive System Information
CVE ID :CVE-2026-66840
Published : Sept. 4, 2026, 7:17 a.m. | 1 hour, 2 minutes ago
Description :XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-66840
Published : Sept. 4, 2026, 7:17 a.m. | 1 hour, 2 minutes ago
Description :XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-69657 - XING CPTrans-ME-X Use of Default Password
CVE ID :CVE-2026-69657
Published : Sept. 4, 2026, 7:17 a.m. | 1 hour, 2 minutes ago
Description :XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID :CVE-2026-69657
Published : Sept. 4, 2026, 7:17 a.m. | 1 hour, 2 minutes ago
Description :XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...