EUVD-2026-95338

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute unauthorized SQL statements due to SQL injection...

EUVD-2026-95339

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal...

EUVD-2026-95332

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow...

EUVD-2026-95334

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database...

EUVD-2026-95337

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow...

EUVD-2026-95333

IBM Guardium Data Protection 12.2.2 could allow a remote attacker to conduct a man-in-the-middle attack due to improper certificate validation...

EUVD-2026-95316

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could access file paths outside the intended directory and use observable application responses to determine whether files...

Malicious code in @galicia-toolkit-nestjs-20-lite/commons (npm)

@galicia-toolkit-nestjs-20-lite/commons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon...

PT-2026-108881

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

PT-2026-108907

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system...

PT-2026-108912

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it...

ROS-20261009-73-0036

The vulnerability of the idxdconfdevicerelease function in the drivers/dma/idxd/sysfs.c module of the Intel Data Accelerator driver for the Linux operating system is related to an unvalidated error condition. Exploiting this vulnerability could allow a attacker to cause a service failure...

PT-2026-108909

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the order by parameter because ProcessMakerTraitsTaskControllerIndexMethods::applyColumnOrdering concatenates a...

PT-2026-108870

Name of the Vulnerable Software and Affected Versions GDPR Data Request Form versions prior to 1.7.2 Description The plugin lacks Cross-Site Request Forgery CSRF protection—a type of attack that forces an authenticated user to execute unwanted actions—when updating specific settings. This allows ...

PT-2026-108915

Name of the Vulnerable Software and Affected Versions ColorFolio versions prior to 1.4 Description BuddhaThemes ColorFolio colorit contains a deserialization of untrusted data flaw that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an applicati...

PT-2026-108914

Name of the Vulnerable Software and Affected Versions Neo | Barber Shop WordPress Theme versions prior to 3.6 Description An issue in the neocut component allows Object Injection due to the deserialization of untrusted data. Object Injection occurs when an application deserializes untrusted data,...

PT-2026-108871

Name of the Vulnerable Software and Affected Versions Livees Checkout WordPress plugin versions prior to 7.0.3 Description The order confirmation page fails to perform capability, nonce, or order-key checks before processing request parameters. This allows unauthenticated users to modify the stat...

PT-2026-108954

Name of the Vulnerable Software and Affected Versions SmarterMail versions prior to build 9777 Description A stored mutation cross-site scripting issue exists where remote attackers can inject executable scripts. This occurs by placing payloads inside a element nested within MathML foreign conten...

PT-2026-108984

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev101 Description The rpc function in api blueprint.py handles multipart/form-data uploads by reading the entire content of the uploaded file into memory using file.read before sending the data to the underlyi...

CVE-2026-48484: Improper Input Validation

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...