Vuldb Updates

A vulnerability has been found in Apple macOS and classified as problematic. This vulnerability affects unknown code of the component App Access. This manipulation causes enforcement of behavioral workflow. This vulnerability is tracked as CVE-2022-42838. The attack is restricted to local execution. No exploit exists. The affected component should be upgraded.

A vulnerability was found in Apple watchOS up to 9.1 and classified as critical. This vulnerability affects unknown code of the component iTunes Store. Such manipulation leads to improper input validation. This vulnerability is uniquely identified as CVE-2022-42837. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability was found in Apple macOS. It has been classified as critical. Impacted is an unknown function of the component iTunes Store. The manipulation leads to improper input validation. This vulnerability is traded as CVE-2022-42837. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. It has been classified as critical. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. This vulnerability is registered as CVE-2026-78143. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipulation of the argument ID leads to authorization bypass. This vulnerability is documented as CVE-2026-78144. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability described as problematic has been identified in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__init__.py. Such manipulation of the argument Next leads to open redirect. This vulnerability is uniquely identified as CVE-2026-78145. The attack can be launched remotely. Moreover, an exploit is present. Upgrading the affected component is recommended.

A vulnerability classified as critical has been found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. This vulnerability was named CVE-2026-78147. The attack may be initiated remotely. There is no available exploit. This vulnerability is distinct from CVE-2026-34159 (GHSA-j8rj-fmpv-wcxw, PR #20908), which only added a buffer==nullptr rejection in create_node() and does not validate op or op_params. The reported GitHub issue was closed automatically due to inactivity.

A vulnerability classified as problematic was found in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The identification of this vulnerability is CVE-2026-78148. The attack may be launched remotely. There is no exploit available. The pull request to fix this issue awaits acceptance.

A vulnerability was found in Open5GS 2.8.0 and classified as critical. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/hss/hss-s6a-path.c of the component S6a Authentication-Information-Request Handler. Such manipulation of the argument Visited-PLMN-Id leads to heap-based buffer overflow. This vulnerability is listed as CVE-2026-78156. The attack may be performed from remote. In addition, an exploit is available. A patch should be applied to remediate this issue.

A vulnerability was found in Open5GS 2.8.0. It has been classified as critical. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-path.c of the component Rx AA-Request Handler. Performing a manipulation results in out-of-bounds read. This vulnerability is cataloged as CVE-2026-78157. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. To fix this issue, it is recommended to deploy a patch.

A vulnerability was found in Open5GS 2.8.0. It has been declared as critical. This vulnerability affects unknown code of the component AMF UEContextReleaseRequest Path Handler. Executing a manipulation can lead to improper authorization. This vulnerability is registered as CVE-2026-78158. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability was found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. It has been rated as critical. This issue affects some unknown processing of the file /user/note.php of the component User Notes Handler. The manipulation of the argument ID leads to authorization bypass. This vulnerability is documented as CVE-2026-78160. The attack can be initiated remotely. Additionally, an exploit exists. Upgrading the affected component is advised.

A vulnerability was found in Dropbox samly. It has been classified as critical. This affects the function Samly.SPHandler.validate_authresp of the file lib/samly/sp_handler.ex of the component SP Handler. The manipulation leads to insufficient verification of data authenticity. This vulnerability is uniquely identified as CVE-2026-53425. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in django-cms django CMS up to 5.0.8 and classified as problematic. This affects the function render_object_structure of the component Placeholder Authorization. Such manipulation of the argument content_type_id/object_id leads to improper authorization. This vulnerability is traded as CVE-2026-61663. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability classified as problematic has been found in BigBlueButton up to 3.0.28. This issue affects some unknown processing of the file akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/presentationpod/RemovePresentationPubMsgHdlr.scala of the component presentationpod. Performing a manipulation of the argument presentationId results in improper privilege management. This vulnerability was named CVE-2026-55489. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

A vulnerability labeled as problematic has been found in Cesanta Mongoose up to 7.21. This affects the function mg_ssi of the file src/ssi.c of the component Ssi. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2026-73255. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

A vulnerability was found in vas3k TaxHacker up to 0.8.2. It has been classified as critical. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials. This vulnerability is documented as CVE-2026-78062. The attack can be initiated remotely. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in Tenda CH22 1.0.0.1. It has been declared as critical. The impacted element is the function formeditFileName of the file /goform/editFileName. The manipulation of the argument editNameMit results in command injection. This vulnerability is reported as CVE-2026-78063. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability was found in itsourcecode Hospital Management System Project in PHP 1.0. It has been rated as critical. This impacts an unknown function of the file /viewservicetype.php. This manipulation of the argument delid causes sql injection. This vulnerability appears as CVE-2026-78112. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability categorized as problematic has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit_user_account.php of the component User Account Update. Such manipulation of the argument id/username leads to improper authorization. This vulnerability is traded as CVE-2026-78115. The attack may be launched remotely. Furthermore, there is an exploit available.