PT-2026-99936

Name of the Vulnerable Software and Affected Versions WatchGuard Access Points affected versions not specified Description An improper access control issue exists within an internal API service. This allows an unauthenticated attacker with network access to the access point to obtain a valid API...

PT-2026-102308

Name of the Vulnerable Software and Affected Versions deepseek-ai deepseek-harness versions prior to 0.1.5-rc.3 Description A security issue exists in the dsh component within the file packages/e2b/e2b/src/index.ts. The manipulation of the E2B API KEY argument leads to a security decision based o...

PT-2026-102358

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description An issue exists in the USB Device Management API within the file usr/lib/lua/luci/controller/api/zrUsb.lua. A remote attacker can perform command injection by manipulating the path argument passed...

CVE-2026-84894: Use After Free

In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API. A remote peer can trigger the stale use by opening a data stream that names an unknown track alias and carrie...

CVE-2026-86102: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system...

PT-2026-102325

Name of the Vulnerable Software and Affected Versions moxygen versions prior to commit 004123dd24c3 Description The MoQSession::dataStreamReadLoop function continues to use a stream read handle after a FIN a signal indicating the end of a data stream has been read. This action invalidates the...

PT-2026-102398

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup wifi. Executing a manipulation of the argument login pwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used...

PT-2026-99869

Name of the Vulnerable Software and Affected Versions NooBaa affected versions not specified Description An OS command injection flaw exists in the set hostname internal function of the 'cluster internal api' component, which manages the Multi-Cloud Object Gateway in OpenShift Data Foundation. Th...

CVE-2026-82930: Missing Authentication for Critical Function

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

CVE-2026-96740: Use of Externally-Controlled Input to Select Classes or Code

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

PT-2026-99871

Name of the Vulnerable Software and Affected Versions dbgate versions prior to 7.3.2 Description A path traversal flaw exists in the Create Connection Endpoint component. The issue occurs within the zipJsonLinesData function located in the packages/api/src/utility/zipJsonLinesData.js file. By...

PT-2026-99963

Name of the Vulnerable Software and Affected Versions StreamsHub Console for Apache Kafka affected versions not specified Description A flaw exists where tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without...

PT-2026-99771

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.15.0 Description An incorrect authorization issue exists within the Permission Validation component. The flaw allows remote exploitation by manipulating the employee argument in the get expense claims, get shift...

CVE-2026-101187: Improper Neutralization of Special Elements used in a Command

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function popusbdevice of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes command injection. The attack is...

CVE-2026-101006: Incorrect Authorization

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function getexpenseclaims/getshiftrequests/getattendancerequests of the file hrms/api/init.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote...

CVE-2026-12342: Improper Input Validation

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

PT-2026-99864

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

CVE-2026-101260: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit...

PT-2026-99776

Name of the Vulnerable Software and Affected Versions WP Verify API WordPress plugin version 1.0.0 Description An authorization check is missing in a REST route, which allows unauthenticated users to insert arbitrary data into the plugin database table. Additionally, this flaw enables the site to...

PT-2026-99942

Name of the Vulnerable Software and Affected Versions WatchGuard AP affected versions not specified Description An OS command injection flaw exists in the internal API service. This issue allows an attacker with network access to the access point to execute arbitrary shell commands on the...