CVE-2026-108945

iMoonLab yolov13 AutoBackend Model Loading autobackend.py eval code injection

A vulnerability was detected in iMoonLab yolov13 up to 73289949533efac82bb5f72ec19b746618656bd2. Affected by this issue is the function eval of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. Performing a manipulation of the argument imgsz/names/kpt_shape results in code injection. The attack must be initiated from a local position. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Imoonlab

Products

Yolov13

CVE-2026-108941

Linketic CityGaussian Sidecar Parsing common.py parse_cfg_args code injection

A vulnerability was identified in Linketic CityGaussian up to 2.0. This affects the function parse_cfg_args of the file internal/utils/common.py of the component Sidecar Parsing. The manipulation of the argument cfg_args leads to code injection. The attack can only be performed from a local environment. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Linketic

Products

Citygaussian

CVE-2026-108916

Edimax BR-6208AC formAccept command injection

A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 6.9 Medium EPSS 1.7% KEV · Not listed

Vendors

Edimax

Products

Br-6208ac Br-6208ac Firmware

CVE-2026-108900

Exponent CMS XML-RPC xmlrpc.php userLogin sql injection

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Exponent

Products

Cms

CVE-2026-108829

Zen Cart Module Configuration modules.php sql injection

A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 08f572654edee1db8f9db091c9949825c6c69339. It is advisable to implement a patch to correct this issue.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Zen-cart Zen Cart

Products

Zen Cart Zen Cart

CVE-2026-108816

agno-agi agno PythonTools python.py run_python_code code injection

A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function run_python_code of the file python.py of the component PythonTools. The manipulation of the argument code results in code injection. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Agno-agi

Products

Agno

CVE-2026-108782

erzhongxmu JEEWMS Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList sql injection

A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulation of the argument trem/searchField/entityName can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Erzhongxmu Jeewms

Products

Jeewms Jeewms

CVE-2026-108777

erzhongxmu JEEWMS WvGiController.java WvGiController.list sql injection

A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Erzhongxmu Jeewms

Products

Jeewms Jeewms

CVE-2026-108684

erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection

A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql injection. The attack can be initiated remotely. The patch is named 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jeewms

Products

Jeewms

CVE-2026-108571

Xinhu Rainrock RockOA Openkqj Action openkqjAction.php returnchuli sql injection

A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkqjAction.php of the component Openkqj Action. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Xinhu

Products

Rainrock Rockoa

CVE-2026-108957

TinyLLaVA TinyLLaVA_Factory TinyLlavaConfig configuration_tinyllava.py _load_text_config code injection

A security flaw has been discovered in TinyLLaVA TinyLLaVA_Factory up to 1abc6ac5e76a68d0fd087a071b56da968e69ca9b. The impacted element is the function _load_text_config of the file tinyllava/model/configuration_tinyllava.py of the component TinyLlavaConfig. Performing a manipulation of the argument llm_model_name_or_path results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tinyllava

Products

Tinyllava Factory

CVE-2026-108943

ModelTC LightX2V Tokenizer cosmos3_runner.py AutoTokenizer.from_pretrained code injection

A weakness has been identified in ModelTC LightX2V up to 0.5.0. Affected is the function AutoTokenizer.from_pretrained of the file lightx2v/models/runners/cosmos3/cosmos3_runner.py of the component Tokenizer. This manipulation of the argument auto_map causes code injection. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Modeltc

Products

Lightx2v

CVE-2026-108927

itsourcecode Baptism Information Management System pbaptism.php sql injection

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulation of the argument b_id causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Baptism Information Management System

CVE-2026-108918

Edimax BR-6208AC formWlanMP command injection

A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed

Vendors

Edimax

Products

Br-6208ac Br-6208ac Firmware

CVE-2026-105848

Payload: Insufficient Access Control in Stripe REST Proxy

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST proxy can perform unintended Stripe operations. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Payloadcms

Products

Payload Plugin-stripe

CVE-2023-29383

shadow: Improper input validation in shadow-utils package utility chfn

In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc/passwd file when viewed. Use of \r manipulations and Unicode characters to work around blocking of the : character make it possible to give the impression that a new user has been added. In other words, an adversary may be able to convince a system administrator to take the system offline (an indirect, social-engineered denial of service) by demonstrating that "cat /etc/passwd" shows a rogue user account.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Shadow Project

Products

Shadow

CVE-2023-27533

curl: TELNET option IAC injection

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform option negotiation without the application's intent. This vulnerability could be exploited if an application allows user input, thereby enabling attackers to execute arbitrary code on the system.

CVSS 3.1 · 9.8 Critical EPSS 2.2% KEV · Not listed

Vendors

Fedoraproject Haxx Netapp and 2 more

Products

Fedora Curl Active Iq Unified Manager and 12 more

CVE-2026-108827

Zen Cart Administrative Module Management general.php zen_call_function code injection

A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zen_call_function of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument use_function can lead to code injection. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor explains: "We don't consider this an independently exploitable vulnerability. The only path to controlling `use_function`/`configuration_value` in the `configuration` table is the SQL Patch tool (raw arbitrary SQL execution) or a pre-existing SQL injection elsewhere".

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Zen-cart Zen Cart

Products

Zen Cart Zen Cart

CVE-2026-108814

SEMCMS SEMCMS_Banner.php sql injection

A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMS_Banner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Semcms

Products

Semcms

CVE-2026-108806

krupalshah EmployeeRecruitmentSystem Forgot Password authprocessing.php mysql_query sql injection

A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Krupalshah

Products

Employeerecruitmentsystem