CVE Vulnerabilities - 18 October 2026

itsmeravitejak Online-Examination System may let attackers alter data

CVE-2026-111992

The exam start feature in the itsmeravitejak Online-Examination System can be tricked by sending a specially crafted topic identifier, allowing an attacker to change or view information stored in the ...

2.1

yolov9 can be tricked into running remote code

CVE-2026-111991

The yolov9 version 0.1 model contains a flaw in its ONNX metadata handling that lets an attacker insert malicious code when the system processes certain inputs. This could allow an attacker to run arb...

2.1

stable-diffusion-webui can run foreign code remotely

CVE-2026-111986

The web interface of AUTOMATIC1111's stable-diffusion-webui (up to version 1.10.1) lets an attacker send specially crafted data that causes the server to execute their own commands. This can be trigge...

2.1

alexpasmantier television lets local users run commands

CVE-2026-111876

The television software version up to 0.15.9 lets someone with local access change a setting in the Entry::output function to execute arbitrary system commands. This could let an attacker run unwanted...

1.9

David-Crty Databasement up to 1.8.1 allows unauthorized restore

CVE-2026-111875

The software’s scheduled‑restore feature can be tricked into processing a request without proper permission when the schema_name value is manipulated. This can be done over the network and could let a...

2.0

stable-diffusion-webui can run malicious scripts in browsers

CVE-2026-111987

The web interface of AUTOMATIC1111’s stable‑diffusion‑webui (up to version 1.10.1) lets an attacker insert specially crafted data that causes a web page to execute unwanted script code. This can be tr...

2.1

stable-diffusion-webui may consume excessive resources when queried

CVE-2026-111985

The web interface used for generating images can be tricked into using a lot of memory or CPU when it processes specially crafted files. An attacker could send such a file over the network and cause t...

2.1

stable-diffusion-webui Card Builder allows remote script injection

CVE-2026-111984

The Card Builder feature in the stable-diffusion-webui project can be tricked into running malicious code when a specially crafted file name is used. This could let an attacker execute unwanted script...

2.1

Blood Bank Management System lets attackers inject code via search

CVE-2026-111942

The Blood Bank Management System version 1.0.0 has a weakness in the page /abs.php. An attacker can send a specially crafted search query that makes the system run unwanted code in a visitor’s web bro...

2.1

Books4Cash search page can run attacker code

CVE-2026-111877

The search page (search.php) in the Books4Cash system can be tricked with a crafted search term to make the web page run code supplied by a remote attacker. This could let the attacker steal informati...

2.1

light0011 CMS weak SHA-1 password hashing

CVE-2026-112026

The content management system light0011 CMS stores passwords using the outdated SHA‑1 algorithm, which can be broken more easily than modern methods. This makes it possible for attackers to guess or r...

2.9

OpenCATS Career Portal allows unlimited login attempts

CVE-2026-111874

The login page in OpenCATS version 0.10.0 does not properly limit how many times a user can try to sign in, letting attackers repeatedly guess passwords. This can lead to account takeover if combined ...

2.9

Red Hat archive utilities can be tricked to stop working

RHSA-2026:77775

The Red Hat packages bsdcat, bsdcpio, bsdtar, bsdunzip and libarchive may crash if they process a specially crafted archive file. This could temporarily stop the applications from working, affecting a...

3.6

Soarkey StudentManagement stores passwords in plain text

CVE-2026-111993

The StudentManagement system saves user passwords exactly as typed, without encryption. This makes the credentials readable to anyone with access to the server, potentially exposing student and staff ...

1.9

Gitify allows attackers to link your account to theirs

CVE-2026-112050

Versions of Gitify older than 7.10.0 have a flaw in the login process that can let a malicious website trick a user into connecting the attacker’s account to their client. This could cause the user to...

2.3

Teable lets users rename any folder across bases

CVE-2026-112004

In Teable, a signed‑in user can change the name of a folder that belongs to a different workspace by sending a specially crafted request. The system only checks the workspace ID in the URL, not the fo...

2.3

Linux kernel can allow unauthorized code execution

DEBIAN-CVE-2025-71133 CVE-2025-71133 ROOT-OS-DEBIAN-13-CVE-2025-71133 ROOT-OS-DEBIAN-12-CVE-2025-71133

Several Linux kernel packages, including the standard kernel and variants from Debian and Canonical, contain a weakness that could let an attacker run their own code on the system. This could lead to ...

3.1

diem up to 5.1.3 allows easy password cracking

CVE-2026-112029

The diEM software (versions through 5.1.3) uses a weak method to store passwords, making them easier to guess if an attacker can get access to the password file. This risk is only realistic for someon...

1.1

BIRD daemon can let peers filter traffic improperly

CVE-2026-112112

The BIRD Internet Routing Daemon’s IPv6 flow rules can be tricked, allowing a trusted network partner to add rules that affect traffic outside the intended address range. This could cause unauthorized...

2.3