CVE-2023-35065

SQLi in Osofts Paint Production Management

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Osoft Paint Production Management allows SQL Injection. This issue affects Paint Production Management: before 2.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Osoft

Products

Dyeing - Printing - Finishing Production Management

CVE-2023-35064

SQLi in Satos Mobile

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Satos Satos Mobile allows SQL Injection through SOAP Parameter Tampering. This issue affects Satos Mobile: before 20230607.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Satos

Products

Satos Mobile

CVE-2023-35072

SQLi in Coyav Travels Proagent

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Coyav Travel Proagent allows SQL Injection. This issue affects Proagent: before 20230904 .

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Coyavtravel

Products

Proagent

CVE-2023-35071

SQLi in MRV Tech's Logging Administration Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MRV Tech Logging Administration Panel allows SQL Injection. This issue affects Logging Administration Panel: before 20230915 .

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mrv

Products

Logging Administration Panel

CVE-2023-35070

SQL in VegaGroup Web Collection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VegaGroup Web Collection allows SQL Injection. This issue affects Web Collection: before 31197.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Vegagroup

Products

Web Collection

CVE-2023-3319

XSS in iDisplays PlatPlay DS

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iDisplay PlatPlay DS allows Stored XSS. This issue affects PlatPlay DS: before 3.14.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Idisplay

Products

Platplay Ds

CVE-2023-3374

Privilege Escalation in Bookreen

Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation. This issue affects Bookreen: before 3.0.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Bookreen

Products

Bookreen

CVE-2023-3375

Unrestricted File Upload in Bookreen

Unrestricted Upload of File with Dangerous Type vulnerability in Unisign Bookreen allows OS Command Injection. This issue affects Bookreen: before 3.0.0.

CVSS 3.1 · 7.2 High EPSS 1.4% KEV · Not listed

Vendors

Bookreen

Products

Bookreen

CVE-2023-3376

SQLi in Digital Strategys Zekiweb

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digital Strategy Zekiweb allows SQL Injection. This issue affects Zekiweb: before 2.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Dijital

Products

Zekiweb

CVE-2023-3377

SQLi in Veribilim's Veribase

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veribilim Software Computer Veribase allows SQL Injection. This issue affects Veribase: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Veribase

Products

Veribase

CVE-2023-3386

SQLi in a2 Camera Trap Tracking System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 Camera Trap Tracking System allows SQL Injection. This issue affects Camera Trap Tracking System: before 3.1905.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

A2technology

Products

Camera Trap Tracking System

CVE-2023-3522

SQLi in a2 License Portal System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in a2 License Portal System allows SQL Injection. This issue affects License Portal System: before 1.48.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

A2technology

Products

License Portal System

CVE-2023-3616

SQLi in Mava Softwares Hotel Management System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mava Software Hotel Management System allows SQL Injection. This issue affects Hotel Management System: before 2.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mava

Products

Hotel Management System

CVE-2023-3631

SQLi in Medart Notification Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Medart Health Services Medart Notification Panel allows SQL Injection. This issue affects Medart Notification Panel: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Medart Notification Panel Project

Products

Medart Notification Panel

CVE-2026-4698

JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Firefox Esr

CVE-2026-23280

accel/amdxdna: Prevent ubuf size overflow

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Prevent ubuf size overflow The ubuf size calculation may overflow, resulting in an undersized allocation and possible memory corruption. Use check_add_overflow() helpers to validate the size calculation before allocation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-23283

regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()

In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read() In fp9931_hwmon_read(), if regmap_read() failed, the function returned the error code without calling pm_runtime_put_autosuspend(), causing a PM reference leak.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-23285

drbd: fix null-pointer dereference on local read error

In the Linux kernel, the following vulnerability has been resolved: drbd: fix null-pointer dereference on local read error In drbd_request_endio(), READ_COMPLETED_WITH_ERROR is passed to __req_mod() with a NULL peer_device: __req_mod(req, what, NULL, &m); The READ_COMPLETED_WITH_ERROR handler then unconditionally passes this NULL peer_device to drbd_set_out_of_sync(), which dereferences it, causing a null-pointer dereference. Fix this by obtaining the peer_device via first_peer_device(device), matching how drbd_req_destroy() handles the same situation.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-32323

Mullvad VPN for macOS: Local Privilege Escalation via unverified bundle path in installer

Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer package executes binaries from /Applications/Mullvad VPN.app without verifying if the bundle is attacker-controlled or that the path is the legitimate Mullvad application. A user in the admin group can pre-place a crafted application bundle at that location and may be able to achieve code execution as root. Since the issue only affected the installer, there is no immediate need for users to update if they are already running an older version. This issue has been fixed in version 2026.2-beta1.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mullvad

Products

Mullvad Vpn

CVE-2026-32312

GLPI: Unauthorized export of form structure

GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue has been fixed in version 11.0.7.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Glpi-project

Products

Glpi