PT-2026-83867

Name of the Vulnerable Software and Affected Versions QD versions 20220208 through 20250803 Description An unauthenticated remote attacker can perform a Server-side request forgery SSRF via the '/har/test' endpoint. The Fetcher.build request function in libs/fetcher.py creates an...

PT-2026-83684

Improper Encoding or Escaping of Output vulnerability in ash-project ash admin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

PT-2026-83893

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the delUrlFilterRules function allows unauthenticated attackers to remove URL filtering rules. This is achieved by sending a crafted POST request to the...

CVE-2026-72001: Authorization Bypass Through User-Controlled Key

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...

CVE-2026-82394: Missing Authorization

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in...

CVE-2026-82660: Missing Authorization

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

RHEL 9 : NetworkManager (RHSA-2026:61243)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61243 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

PT-2026-83729

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpoint url leads to server-side request forgery. It is possib...

PT-2026-83993

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.6 Description An issue exists where administrator-configured OpenID Connect OIDC token url and user info url variables within the handle oidc callback.php file are used directly in the curl init function without...

CVE-2026-70449: Improper Limitation of a Pathname to a Restricted Directory

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files from the web application, including files under WEB-INF that the servlet container would not otherwise serve. The locale, style and variation attributes decoded from a package...

CVE-2026-51719

The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , contains an incorrect access control vulnerability in the delUrlFilterRules function. This flaw allows unauthenticated attackers to remove URL filtering rules by sending a specially crafted POST request t...

CVE-2026-51719: Improper Access Control

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83847

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...

RHEL 9 : NetworkManager (RHSA-2026:61341)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61341 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

Linux Distros Unpatched Vulnerability : CVE-2026-82660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local...

PT-2026-83859

Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

RHEL 8 : NetworkManager (RHSA-2026:61580)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61580 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

PT-2026-84020

Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description URL uploads in php/elFinder.class.php can bypass server-side request forgery SSRF protections when PHP cURL is unavailable. The validate address function validates the IP address, but get remote...

Linux Distros Unpatched Vulnerability : CVE-2026-82249

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carria...

CVE-2026-82639

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...