CVE Vulnerabilities - 2 October 2026

The web‑based loan management software from CodeAstro lets attackers send specially crafted data to the admin page (index.php) and run their own database commands. This could let a remote user view, a...

The delete.php page in CodeAstro Simple Pharmacy Management System lets an attacker send a specially crafted ID value that manipulates the database. This can be done over the network and may result in...

The Simple Pharmacy Management System version 1.0 lets an attacker change the ID value in the product view page to run unauthorized commands against the database. This could let attackers view, change...

The confirm.php page in the itsourcecode Online Admission System lets an attacker send specially crafted input in the ID field, causing the system to run unintended database commands. This can be done...

The Cal.com DIY service (versions up to 6.2.0) has a flaw in its booking permission check that can let someone gain access to bookings without proper authorization. This can be triggered over the netw...

The Pet Shop Management System version 1.0 contains a flaw in the admin_reservefilter.php file that lets an attacker add malicious code to the database queries. This can be triggered over the internet...

The admin_reject_completed.php page in itsourcecode Pet Shop Management System lets an attacker change the ID value and insert malicious commands into the database from anywhere on the Internet. This ...

Versions of Next.js from 16.0.0 through 16.3.7 run a development server that does not properly block requests from other web pages. A malicious site visited by a developer could read the project's fol...

The announcement feature in the SourceCodester Student Result Management System lets an attacker add harmful code to the title of a new announcement. When other users view the announcement, the malici...

The Booking Calendar add‑on for WordPress (versions up to 11.8.4) can be tricked into processing two requests at the same time, which may let an attacker create or change bookings they shouldn’t contr...

Simulink versions before the 2026b release can be tricked by a specially crafted .slx model file. The file can contain blocks that never appear in the editor but are executed when the model is opened,...

The poppler, poppler-cpp, poppler-cpp-devel, poppler-devel, and poppler-glib packages from Red Hat contain a flaw that could be triggered by specially crafted files, potentially causing the program to...

The Otter Blocks plugin for WordPress allows users with a subscriber account or higher to see the email addresses, submission dates, and total count of the five most recent form entries through a dash...

The Motors add‑on for WordPress (versions earlier than 1.4.124) does not check that a user is allowed to edit a specific listing. A user with a basic subscriber account can alter the details of listin...

If you use Trivy versions earlier than 0.71.0 to scan Terraform configurations, the tool may access files above the directory you set for scanning. This can unintentionally expose sensitive informatio...

The xxhash‑rust library (version 0.8.15) lets programs provide a secret that is shorter than required. When this happens in a normal (release) build, the code can create an invalid memory reference, w...

The Rust library xxhash‑rust version 0.8.15 can create an invalid memory reference if a custom secret used for hashing is shorter than required. This can cause the program to behave unpredictably or s...

Versions of the Wasmtime WebAssembly runtime (up to 46.0.2 and 47.0.3) can encounter crashes, invalid memory access, or data corruption when certain large operations are interrupted or trigger callbac...

The Denuvo Anti‑Tamper protection used in some software can be tricked into believing it is not running inside a virtual machine. This lets attackers bypass checks that are meant to stop tampering too...