PT-2026-110502

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMS User.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...

EulerOS 2.0 SP13 : python3 (EulerOS-SA-2026-4101)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : unicodedata.normalize can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters wi...

EulerOS 2.0 SP11 : python3 (EulerOS-SA-2026-4373)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML...

EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-4057)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : i2c: stub: Reject I2C block transfers with invalid lengthCVE-2026-64191 USB: serial: mctu232: fix memory corruption with small...

EulerOS 2.0 SP13 : kernel (EulerOS-SA-2026-4148)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : i2c: stub: Reject I2C block transfers with invalid lengthCVE-2026-64191 USB: serial: mctu232: fix memory corruption with small...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-4241)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : fanotify: fix false positive on permission eventsCVE-2026-46150 nfsd: never defer requests during idmap lookupCVE-2026-45983 fbdev: defio:...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-4332)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : fanotify: fix false positive on permission eventsCVE-2026-46150 nfsd: never defer requests during idmap lookupCVE-2026-45983 fbdev: defio:...

CVE-2023-54409: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who vie...

PT-2026-110723

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.13 Description An authorization flaw exists in the actionSwitchToLicensedEdition function within the AppController. This issue allows any authenticated user to change the installed software edition...

PT-2026-110715

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.11.0 through 0.11.3 Description The software uses a regex engine for its knowledge and chat file search tools that expands nested counted repetition unbounded at compile time and caches the result. Authenticated users can...

PT-2026-110708

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.33 through 0.11.3 Description Authenticated users can execute scripts in other users' sessions by storing javascript: URLs within the citation embed url fields. An attacker can share a specially crafted chat; when a...

PT-2026-110773

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0 Description An authorization flaw exists in the PortsController::purge function. Users with global-read permissions can bypass authorization to physically delete ports without having the required delete...

PT-2026-110660

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.31.0 Description An incorrect permission assignment allows local users to read private keys created by the crypto write pem function that lack owner-only permissions. On multi-user Unix hosts, attackers can...

PT-2026-110998

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 13.46.1 Frappe versions prior to 14.20.0 Description Authenticated attackers can execute scripts in the browsers of users who view rendered content. This occurs because the html2text function weakly sanitizes...

PT-2026-110725

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0 through 4.18.6 Craft CMS versions 5.0.0 through 5.10.13 Description Authenticated control panel users with the performUpdates permission or Updates-utility access can execute arbitrary code. The issue occurs because th...

PT-2026-110961

Name of the Vulnerable Software and Affected Versions Super Productivity versions 17.3.0 through 18.13.0 Description The SuperSync end-to-end encryption E2EE setup calls the synctrue function before a user defines an encryption password. This causes the operation-upload path to transmit and store...

PT-2026-110772

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0 Description A stored cross-site scripting issue exists in the get oxidized nodes list function. The application fails to escape Oxidized API fields and the SNMP sysName variable. An attacker who can control th...

Multiple vulnerabilities in Thelia 2.6.0 and 2.6.1

Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of these issues could enable remote code execution RCE, server-side template injection SSTI, stored...

PT-2026-110557

Name of the Vulnerable Software and Affected Versions lamp-cloud versions prior to 5.10.2 Description An insecure direct object reference occurs when an application provides direct access to objects based on user-supplied input. Authenticated users can obtain storage URLs for files belonging to...

TencentOS Server 3: postgresql:16 (TSSA-2026:1111)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1111 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...