CVE-2024-1100

SQLi in Vadi Corporate Information Systems' DIGIKENT GIS

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vadi Corporate Information Systems DIGIKENT GIS allows SQL Injection. This issue affects DIGIKENT GIS: through 2.23.5.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Vadi

Products

Digikent Gis

CVE-2024-0947

Cookies Manipulation in Talya Informatics' Elektraweb

Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Manipulation, Accessing/Intercepting/Modifying HTTP Cookies, Manipulating Opaque Client-based Data Tokens. This issue affects Elektraweb: before v17.0.68.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Talya Informatics

Products

Elektraweb

CVE-2024-0857

SQLi in Universal Software's FlexWater Corporate Water Management

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Universal Software Inc. FlexWater Corporate Water Management allows SQL Injection. This issue affects FlexWater Corporate Water Management: before 5.452.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Uni-yaz Universal Software Inc

Products

Flexwater Corporate Water Management Flexwater Corporate Water Management

CVE-2024-0851

SQLi in Grup Arge Energy and Control Systems's Smartpower

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Grup Arge Energy and Control Systems Smartpower allows SQL Injection. This issue affects Smartpower: through V24.05.27.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Gruparge

Products

Smartpower

CVE-2019-25719

Dräger Infinity M540 VG4.1.1 Spoofing and DoS via Network Message Handling

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message handling vulnerabilities that allow network-adjacent attackers to spoof or tamper with data and cause denial-of-service conditions. Attackers with access to an enabled Infinity network port or physical proximity to a wireless access point can modify device settings such as alarm states or alarm limits, and overwhelm the system with incoming data causing the device to reboot and lose network functionality.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Draeger

Products

Infinity Acute Care System Standalone Infinity M540 Patient Monitor

CVE-2026-10221

NousResearch hermes-agent run_agent.py _compress_context injection

A vulnerability was identified in NousResearch hermes-agent up to 0.12.0. Affected by this vulnerability is the function _compress_context of the file run_agent.py. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nousresearch

Products

Hermes-agent

CVE-2026-45676

OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI's replacement ELF parser trusts section offsets, counts, and string offsets from the executable file. A crafted local ELF can make OBI dereference invalid section pointers or slice past string tables, causing the agent to panic while determining the process language. This issue has been patched in version 0.9.0.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Opentelemetry

Products

Ebpf Instrumentation Opentelemetry-ebpf-instrumentation

CVE-2026-10284

DevaslanPHP project-management Livewire ViewTicket.php doDeleteComment improper authorization

A flaw has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this vulnerability is the function editComment/doDeleteComment of the file app/Filament/Resources/TicketResource/Pages/ViewTicket.php of the component Livewire Handler. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Devaslanphp

Products

Project-management Project Management

CVE-2026-47324

Stored XSS in Multiple Points in ProjectsAndPrograms school-management-system

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes of students and teachers objects. An authorized attacker (e.g., a teacher or administrator) can inject malicious JavaScript that is subsequently executed in other users’ browsers. Critically, when chained with CVE‑2025‑11661, which allows unauthenticated access to backend endpoints, this vulnerability can be exploited by a remote attacker without privileges to inject and execute arbitrary JavaScript. The maintainers were notified early about this vulnerability but did not provide details regarding affected versions. The version corresponding to commit 6b6fae5 was tested and confirmed vulnerable; other versions were not tested and may also be affected.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Projectsandprograms

Products

School Management System

CVE-2026-10295

SourceCodester Customer Review App review_app.py get_all_reviews denial of service

A vulnerability was found in SourceCodester Customer Review App 1.0. Affected by this vulnerability is the function add_review/save_review/get_all_reviews of the file review_app.py. Performing a manipulation of the argument name/comment results in denial of service. The attack requires a local approach. The exploit has been made public and could be used.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Customer Review App

CVE-2026-23638

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated attacker to tamper with the internal approval flow configurations of forms belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24751

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24752

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24753

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24754

Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a stored XSS vulnerability in Kiteworks Secure Data Forms could allow an authenticated attacker to execute arbitrary JavaScript code in other users' sessions. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24755

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-10584

HTTPS Fallback to HTTP in Graph Explorer

Proxy server in Graph Explorer before 3.0.1 falls back to HTTP when certificate files are missing, which might allow remote threat actors to obtain sensitive information via interception of requests intended to be sent over HTTPS. To remediate this issue, users should upgrade to Graph Explorer v3.0.1 or later.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Graph Explorer

CVE-2026-24756

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24761

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to access metadata of resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms

CVE-2026-24782

Kiteworks Secure Data Forms has a SQL Injection vulnerability

Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Accellion Kiteworks

Products

Kiteworks Secure Data Forms