CVE Vulnerabilities - 28 September 2026

FastStone Image Viewer (versions up to 8.3) can be sent a specially crafted PCX image that makes the program read memory it shouldn't. This could lead to crashes or unintended exposure of information,...

FastStone Image Viewer versions up to 8.3 may read beyond the intended area when handling specially crafted TGA image files. This could let an attacker cause the program to expose information or becom...

FastStone Image Viewer versions up to 8.3 contain a flaw in its image‑decoding code that can write data outside of its intended memory area. An attacker on the network could trigger this and potential...

FastStone Image Viewer versions up to 8.3 can be tricked by a specially crafted TGA picture file to write data outside its intended memory area. This can let an attacker run their own code on a user’s...

The Eleveo Call Recording software (version 9.7.0) has a flaw in its search function that can let people on the network view or change recordings without permission. An attacker could exploit this fro...

The web page used for uploading questionnaire audio in Eleveo Quality Management 9.7.0 can be manipulated to reach files outside its intended folder. An attacker from anywhere on the internet could vi...

The Matrimonial System version 1.0 lets attackers send specially crafted data to the profile creation page and run their own database commands. This could let them view, change, or delete personal inf...

The deepseek-harness version 0.1.7-rc.2 contains a mistake in the Landlock component that can let someone running code on the same machine escape the intended sandbox protections. This could allow a l...

The Unet Web Service up to the August 2026 release lets anyone send a file to the /exchange/attachment/upload page without checks. An attacker could place malicious files on the server, potentially le...

Versions 1.2.1 through 1.2.4 and the beta 2.0.0 of DevaslanPHP project‑management contain a flaw in the Timesheet MonthlyReport feature that lets an attacker send specially crafted data and run their ...

The Timesheet Dashboard component in DevaslanPHP project‑management (versions 1.2.1 through 2.0.0‑beta1) lets an attacker send specially crafted input that runs unauthorized database commands. This ca...

The updateguest.php page in the CloudClassroom-PHP-Project can be tricked into running unauthorized database commands when a specially crafted guest name is supplied. This can be done from anywhere on...

The Mini Inventory and Sales Management System's database query builder lets an attacker change the orderBy setting to inject harmful database commands, which can be done from anywhere on the internet...

The DevaslanPHP project‑management tool (versions 1.2.1 through 1.2.4 and v2.0.0‑beta1) has a function that can be tricked into sending arbitrary requests to other servers. An attacker can supply a cr...

The FLB-Music Player versions 1.1.8 through 1.2.1 can be tricked into using a file path that moves outside its intended folder. This could let a local user access or modify files they shouldn't. Updat...

The file‑handling component in Tencent AI-Infra-Guard (versions up to 4.5.2 and 4.6.2) can be tricked into accessing files outside its intended folder when a local user supplies a crafted path. This c...

The group editing page in dayrui XunruiCMS (versions up to 4.7.2) allows a remote attacker to send specially crafted data that can change or reveal information stored in the database. This happens bec...

The aaPanel BaoTa control panel (versions up to 11.8.0) lets an attacker send specially crafted input to the get_domain_status function, causing the system to run unintended database commands. This ca...

The aaPanel control panel (versions up to 11.8.0) contains a flaw in its data handling code that can be triggered over the network. By sending a specially crafted request, an attacker can inject comma...

The Eleveo Quality Management 9.7.0 software can unintentionally expose internal information when its audit‑recording feature is used. This can be triggered from outside the network, allowing attacker...

The user management page in Eleveo Call Recording Software can be tricked into sending malicious directory queries, letting an attacker manipulate or view data stored in the LDAP directory. This can b...

The Eleveo Quality Management system (version 9.7.0) can expose internal information when the QMBODownload page is accessed. This can be triggered from outside the network, and the method for doing so...

The Frappe HR system (versions up to 16.15.0) does not correctly check who is requesting attendance, expense, or shift information, so a user could see data they shouldn’t. This can be triggered from ...

If a user is logged in to Langflow version 1.0.16 up to but not including 1.12.0 (or 0.0.94 up to but not including 1.12.0), they can cause the system to execute arbitrary Python code by submitting a ...

Flatpak on Debian and Red Hat Enterprise Linux (versions 7‑10) creates temporary folders for installing apps that are set so anyone on the computer can read or change them. On a machine where users sh...