CVE Vulnerabilities - 6 October 2026

aiohttp library update stops possible attacker takeover

ROOT-APP-PYPI-CVE-2025-53643 DEBIAN-CVE-2025-53643 GHSA-9548-qrrj-x5pj CVE-2025-53643

The aiohttp web‑framework used in several Python packages has been found to contain a security weakness that could let an attacker run code on your server. Updated versions of aiohttp from the officia...

1.7

SourceCodester Performance Indicator System lets attackers alter data

CVE-2026-105957

The web page that shows product details in the Performance Indicator System can be tricked by sending a specially crafted Category value. This lets a remote attacker run their own commands on the syst...

2.1

Kusalkasilva Learning Management System can be tricked into database attacks

CVE-2026-105921

The search_class.php component of the Kusalkasilva Learning Management System accepts a school_year input that can be manipulated to run unauthorized database commands. An attacker can exploit this fr...

2.1

reNgine listTargets endpoint allows remote command execution

CVE-2026-105487

The reNgine tool (versions up to 2.2.0) has a flaw in its listTargets function that lets an attacker send specially crafted input to run operating system commands on the server. This can be triggered ...

2.1

Online Appointment Booking System allows remote data manipulation

CVE-2026-105472

The booking page (book.php) in the Online Appointment Booking System can be tricked by sending specially crafted information in the Doctor/appointment field, causing the system to run unintended comma...

2.1

jshERP financial receipt update can bypass permissions

CVE-2026-105621

The updateAccountHeadAndDetail function in jshERP versions up to 3.5 does not correctly check who is allowed to make changes. An attacker could remotely alter financial receipt data without proper app...

2.1

PHPGurukul login system lets password change without proper check

CVE-2026-105703

The change-password feature in the PHPGurukul User Registration & Login and User Management System can be tricked into accepting a wrong current password, allowing someone to change any user's passwor...

2.0

SpringBlade permits unauthorized password changes through ParamController

CVE-2026-105610

The SpringBlade software (versions up to 5.0.1) lets anyone send a specially crafted request to the ParamController component and change the initPassword setting without proper checks. This could let ...

2.0

SourceCodester Student System lets crafted names run code

CVE-2026-105809

The register.php page in SourceCodester Simple Student Information System does not properly clean the first‑name and last‑name fields. An attacker can insert malicious script code that will execute in...

2.1

imgproxy allows remote cross-site scripting via SVG

CVE-2026-105708

imgproxy versions up to 4.0.17 can be tricked when handling SVG images to insert code that runs in a visitor's web browser. An attacker can send a specially crafted SVG and cause the code to execute o...

2.1

SourceCodester Drug Recommendation System can be tricked into unwanted actions

CVE-2026-105706

The Drug Recommendation System version 1.0 can be forced to perform actions on behalf of a logged‑in user without their consent. This could allow an attacker to change settings or submit data while th...

2.1

SourceCodester Drug Recommendation System allows attackers to inject scripts

CVE-2026-105705

The admin page add_drug.php in the SourceCodester Drug Recommendation System can be tricked into running malicious code entered by a user. This could let an attacker display false information, steal l...

2.1

newbee-mall cart quantity can be altered to cause errors

CVE-2026-105573

The shopping cart feature in newbee-mall versions up to 2.7.5 lets an attacker change the quantity value sent to the system, which breaks the business logic for order processing. This can be done over...

2.1

PickMall Lilishop buyer invoice list lets attackers bypass authorization

CVE-2026-105572

The Buyer Invoice List feature in PickMall Lilishop versions up to 4.2.4 can be tricked into accepting a false member ID, allowing anyone on the internet to access or modify invoices they should not s...

2.1

CGA-5wxh-jjq3-46v9

CGA-5wxh-jjq3-46v9

3.7

CGA-v749-qpg4-3q4q

CGA-v749-qpg4-3q4q

3.7

CGA-hm24-87cf-93wv

CGA-hm24-87cf-93wv

3.7

CGA-fm5w-fq6r-72rx

CGA-fm5w-fq6r-72rx

3.7

CGA-jm42-x2hh-84rg

CGA-jm42-x2hh-84rg

3.7

CGA-cjhm-p4cq-5p3q

CGA-cjhm-p4cq-5p3q

3.7

yawkat LZ4 Java can crash when processing many empty blocks

CVE-2026-106449 GHSA-343h-94h5-c4wr UBUNTU-CVE-2026-106449 DEBIAN-CVE-2026-106449

The LZ4 compression library for Java (versions before 1.11.4) can run out of stack space if it receives a compressed file that contains many empty sections. This can cause the program to stop with a S...

3.7

CGA-chc3-x399-59c8

CGA-chc3-x399-59c8

3.7

CGA-v34x-833c-h42p

CGA-v34x-833c-h42p

3.7

CGA-hv5q-9w3h-hf72

CGA-hv5q-9w3h-hf72

3.7

CGA-r32m-g9gx-mwqc

CGA-r32m-g9gx-mwqc

3.7