CVE Vulnerabilities - 25 September 2026

Krayin Laravel-CRM allows role changes without proper checks

CVE-2026-97895

The user management feature in Krayin Laravel-CRM (versions up to 2.2.5) lets an attacker modify the role identifier and gain unintended privileges. This can be triggered from anywhere on the internet...

2.1

CloudClassroom PHP Project managevideos2.php allows remote database access

CVE-2026-97886

The CloudClassroom PHP Project contains a flaw in the managevideos2.php page that lets a remote user tamper with the database by sending specially crafted data to the editassid field. This could let a...

2.1

CloudClassroom PHP Project student update allows remote data tampering

CVE-2026-97884

The updatestudent.php page in the CloudClassroom PHP Project can be tricked into running malicious database commands when a user supplies a crafted value for the "eno" field. This means an attacker co...

2.1

Zhonglun CloudPOS 3.0 update feature allows remote access

CVE-2026-97866

The automatic‑update component in Zhonglun CloudPOS version 3.0 can be tricked into opening a communication channel that anyone on the network can reach. An attacker who sends specially crafted update...

2.9

ningzichun student-management-system allows remote login with default credentials

CVE-2026-97649

The student‑management system includes a database file (example_lite.sql) that still contains the default user name and password. Because the default credentials can be used from the network, an outsi...

2.0

Student Management System addLog page can run malicious code

CVE-2026-97650

The addLog.php page in the Student Management System does not properly check the reason/detail input, allowing attackers to insert harmful scripts that run in users' browsers. This can be triggered fr...

2.1

ningzichun student-management-system allows unauthorized actions

CVE-2026-97648

The student-management-system can be tricked into performing actions on behalf of a user without their consent. This could let an attacker change data or settings remotely, potentially compromising st...

2.1

langchain4j allows remote code execution via data deserialization

CVE-2026-97869 GHSA-gmwr-7wmf-mrjm

The langchain4j library versions up to 1.5.3-beta10, 1.11.10-beta18, and 1.18.1-beta27 can turn specially crafted data into executable code when a specific feature is turned on. An attacker who can wr...

1.2

django-allauth permits unlimited login attempts using accented characters

CVE-2026-97764 UBUNTU-CVE-2026-97764 DEBIAN-CVE-2026-97764

The django-allauth sign‑in system does not properly count failed login tries when users include accented letters, letting an attacker try many passwords without lockout. This can let attackers eventua...

3.7

ImageMagick may crash or exceed memory limits

OESA-2026-4017

The ImageMagick program used for handling many image formats can crash or use more memory than allowed due to coding errors. This can cause temporary service interruptions if an attacker or local user...

3.7

Krayin Laravel-CRM upload feature allows remote script injection

CVE-2026-97896

The upload screen in Krayin Laravel-CRM (versions up to 2.2.5) can be tricked into running malicious code that a visitor sees in their browser. This could let an attacker display unwanted content or s...

2.0

sheshbabu Zen Note Editor allows remote code injection

CVE-2026-97868

The Note Editor in sheshbabu Zen (versions up to 1.5.0) can run malicious code when it displays user‑provided content. An attacker could exploit this to run scripts in a visitor’s browser, potentially...

2.0

PHP MySQL driver may crash from crafted server packet

DEBIAN-CVE-2025-1218 UBUNTU-CVE-2025-1218 CVE-2025-1218 BELL-CVE-2025-1218

The MySQL driver used by PHP 5, 7.0, 7.2, 8.2 and 8.4 on Debian and Ubuntu can read past the end of a data packet if a MySQL server sends an incomplete response. This can cause the PHP process to stop...

3.4

poco 1.14.1 may crash on crafted multipart input

OESA-2026-4091

The Poco C++ library up to version 1.14.1 can crash when it processes a specially crafted multipart message, which could stop the application that relies on it. This can be triggered by someone who ha...

3.3

OpenEuler Poco may crash on crafted input

OESA-2026-4089

The Poco library used in ROS Melodic can crash if it receives specially crafted multipart data, due to a null pointer error. This issue requires local access to exploit, but it could cause service int...

3.3

OpenEuler Poco may crash on crafted input

OESA-2026-4090

The Poco library used in ROS Melodic can crash if it receives specially crafted multipart data, due to a null pointer error. This issue requires local access to exploit, but it could cause service int...

3.3

RustDesk Windows before 1.5 allows file read via clipboard

CVE-2026-100417

In versions of RustDesk for Windows prior to 1.5, the program does not stop a connected remote user from requesting files that were placed on the host's clipboard. This means an authenticated remote u...

2.3

Rapid7 Bulk Export can run unintended queries

CVE-2026-97228

The Bulk Export tool in Rapid7 Platform (versions 0.2.5 to 0.6.1) accepts an export identifier that is inserted directly into a GraphQL request. If a malicious or compromised client supplies a special...

2.7

Sanluan PublicCMS permits unauthorized data export

CVE-2026-97721

The PublicCMS version up to 6.202506.e allows users to change a user or department ID when exporting data, which lets them bypass normal access controls. This means an attacker could retrieve informat...

2.0

Yorisou e Net apps expose hard‑coded encryption key

CVE-2026-75553

The Android and iOS versions of Tohoku Electric Power’s “Yorisou e Net” app contain a secret code that is hard‑coded into the program. Because the code is the same for every installation, anyone who c...

2.4

Zammad agents can view AI error messages from restricted tickets

CVE-2026-63204 GHSA-75j9-hpg4-j9f8

In Zammad versions before 7.1.2, a logged‑in support agent could request an AI summary using any identifier and receive the error message generated for that AI run, even when the related ticket was no...

2.3

Zammad lets attackers delete other users' pending uploads

CVE-2026-65828 GHSA-x4f3-367g-m93g

In Zammad versions before 7.1.2, a web request could remove a temporary file that another user had uploaded, without checking ownership. An attacker who knows the other person's upload identifier can ...

2.3

MediaWiki Cargo extension can run malicious code in tab names

CVE-2026-96874

The Cargo add‑on for MediaWiki lets an attacker store harmful script code in the names of drill‑down tabs, which will run whenever a user views the page. This could let attackers steal data or take ac...

2.3

lazy_html can let attackers run malicious scripts

CVE-2026-92106 EEF-CVE-2026-92106 GHSA-8rqp-v692-v82q

The lazy_html library used to convert HTML can be fooled by specially crafted SVG or MathML content. The hidden code can then execute in a visitor’s browser, potentially exposing data or hijacking the...

2.3

Zammad agents can view restricted knowledge‑base answers

CVE-2026-56730 GHSA-pf47-8964-pp23

In Zammad versions before 7.0.2, a help‑desk agent who is logged in could see knowledge‑base answers they were not supposed to access. The system failed to check the agent’s permission for those answe...

2.1