CVE Vulnerability Catalog

NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue.

NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU resources for which it is not authorized. A successful exploit might lead to code execution, privilege escalation, data tampering, denial of service, and information disclosure.

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service.

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can cause improper release of memory resources, leaving a mapping accessible after the underlying memory is reused. A successful exploit might lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering.

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved. A successful exploit might lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering.

In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

Vulnerability in apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi). On the single-field path, when the matched STATUS line has fewer than three whitespace-separated tokens, sscanf("%*s %*s %s", answer) performs no assignment but the function returns success, and thus the caller prints the uninitialized destination buffer into the HTTP response.

apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and upsfstats.cgi), a related issue to CVE-2026-15544.

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqli_query of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the file User/ord.php of the component Order Placement. Executing a manipulation of the argument id/name can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli_query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Joomla Extension - OrdaSoft Joomla CCK before 8.3.16 has unauthenticated remote code execution. The file site/uploader.php is reached through normal frontend routing (task=getContent), with no authentication or ACL check. The handler validates the uploaded file's content with a real magic-byte MIME check, but the extension allow-list is commented out. The saved file's extension is taken directly from the attacker-supplied filename with no validation, and the file is written to a path under the Joomla web root executed by PHP. An image/PHP polyglot passed the content check with a .php extension.

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible.

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials. A user able to edit the integration could gain access to the authentication data.

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments. This violates data integrity and access control.

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature.

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action. This allows bypassing access control mechanisms.

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible. Malicious code could be stored and executed in the victim's browser.