CVE-2026-105472

girishsaraf Online-Appointment-Booking-System Booking book.php sql injection

A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Handler. This manipulation of the argument Doctor/appointment causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Girishsaraf

Products

Online-appointment-booking-system

CVE-2026-105468

girishsaraf Online-Appointment-Booking-System Login mlogin.php mysqli_query sql injection

A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects the function mysqli_query of the file Admin/mlogin.php of the component Login Handler. Performing a manipulation of the argument uname/pass results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Girishsaraf

Products

Online-appointment-booking-system

CVE-2026-105447

Quay: quay: global read-only superuser can access build trigger write credentials

A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing repository write tokens to global read-only administrative users. An authenticated user with read-only privileges can exploit this flaw by querying the build trigger API to retrieve these delegate tokens. This issue allows a restricted user to bypass read-only limitations and push arbitrary container images to private repositories, leading to privilege escalation.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Quay

CVE-2026-95386

Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-95387

Heap-based Buffer Overflow in Wireshark

SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-95388

Heap-based Buffer Overflow in Wireshark

Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-95389

Heap-based Buffer Overflow in Wireshark

SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-95390

NULL Pointer Dereference in Wireshark

PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-95391

Use After Free in Wireshark

ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-95392

Buffer Over-read in Wireshark

MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-95393

Heap-based Buffer Overflow in Wireshark

CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-95394

Unchecked Input for Loop Condition in Wireshark

Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-95395

Missing Release of Memory after Effective Lifetime in Wireshark

IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-105752

vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracle

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cache_salt value, placing the continuation prefix in the global unsalted cache namespace even when the caller enabled salting. On deployments with prefix caching enabled, which is the default, an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can submit the same continuation and use the cached_tokens_per_turn count to determine whether the prefix was previously processed, defeating the intended tenant isolation of salted prefix caching. This issue is fixed in version 0.30.0.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-105753

vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver assertion in the engine core

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, the default mirrored multimodal LRU cache can commit a media hash in the frontend sender cache during multimodal rendering and before engine admission, while the engine receiver cache never receives the payload if that request is rejected. A later request reusing the same media hash causes MultiModalProcessorSenderCache to send no payload and MultiModalReceiverCache to reach an assertion with the message "Expected a cached item," producing a shared-service availability failure. This issue is fixed in version 0.28.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-105755

vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on `/score` and `/rerank`

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request that reuses a victim's identifier can overwrite the cached query embedding so the victim's documents are scored against the attacker's query, and shared use counters can also cause a late-interaction cache-miss error. This issue is fixed in version 0.30.0.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-105756

vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError` denial of service

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, OpenAI-compatible request models accept a non-empty cache_salt value without enforcing the character and length restrictions required by the IPCCacheServerKey consumer in LMCache-MP. On deployments using the LMCache-MP connector, a salt that contains a forbidden character or exceeds the permitted length can raise an uncaught ValueError during scheduler cache lookup, causing EngineCore to terminate and denying service to all concurrent users. This issue is fixed in version 0.30.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-105757

vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3 sites)

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, structured-output request failures can escape request-scoped validation and reach the EngineCore fatal-error path. A per-request backend mismatch can re-raise a grammar compilation exception, padding produced by the ngram_gpu speculative-decoding mode can pass a negative token to guidance validation, and the Rust frontend can admit empty structured-output values that the Python frontend rejects, allowing ordinary constrained-generation requests to terminate the shared engine. This issue is fixed in version 0.30.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Vllm Vllm-project

Products

Vllm Vllm

CVE-2026-106220

chromium-browser: Information leak in Passwords

Information leak in Passwords in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-106222

chromium-browser: Incorrect authorization in Sync

Incorrect authorization in Sync in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome