CVE watch

CVE-2024-34323 published: ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.

CVE-2024-34321 published: ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.

CVE-2024-34320 published: ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.

CVE-2026-109523 published: A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this vulnerability is an unknown functionality of the file Admin/getclinic.php of the component AJAX Endpoint. The manipul...

CVE-2026-109522 published: A vulnerability has been found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected is an unknown function of the file Admin/deleteclinic.php of the component Admin CRUD Endpoint. The manipulation of the ...

CVE-2026-109521 published: A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected result...

CVE-2026-108185 published: Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.

CVE-2026-108184 published: Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.

CVE-2026-107918 published: Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a cont...

CVE-2026-107917 published: Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a c...

CVE-2026-107460 published: Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating can be bypassed through DNS rebinding. When an application accepts an attacker-controlled image URL for spreadsheet wr...

CVE-2026-106108 published: Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without veri...

CVE-2026-104192 published: Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40, OpaqueObjLoader::CreateStream in src/server/rdb_load.cc can associate one streamNACK with a consumer group's global PEL and a consumer-local PEL, then free the share...

CVE-2026-103028 published: SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-patter...

CVE-2026-102603 published: Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or anoth...

CVE-2026-102342 published: ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript schem...

CVE-2026-102250 published: CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.

CVE-2024-34319 published: A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request.

CVE-2026-109679 published: FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and cr...

CVE-2026-109678 published: FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes a NULL reader-name destination to scard_copy_strings. A malicious RDP server can send an S...