CVE-2026-16088

A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. Th...

CVE-2026-16088 halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal

A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component Files Backup Endpoint. Performing a manipulation results in path traversal. The attack is possible to be carried out remotely. Th...

CVE-2026-16084 Sipeed PicoClaw web.go web_fetch server-side request forgery

A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function webfetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and...

CVE-2026-16084 Sipeed PicoClaw web.go web_fetch server-side request forgery

A weakness has been identified in Sipeed PicoClaw up to 0.2.9. This impacts the function webfetch of the file pkg/tools/integration/web.go. This manipulation causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been made available to the public and...

EUVD-2026-45358

A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipelineexecute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicl...

CVE-2026-16082 Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou

A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipelineexecute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicl...

CVE-2026-16081 Sipeed PicoClaw auth.go cross-site request forgery

A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit has been publicly disclosed and may be...

CVE-2026-9734

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2026-9734

The CVE-2026-9734 entry concerns the W3SC Elementor to Zoho CRM plugin for WordPress. A CSRF vulnerability exists in all versions up to 2.2.0 due to missing or incorrect nonce validation in the storeInfo function, enabling unauthenticated attackers to alter Zoho CRM integration settings by forgin...

CVE-2026-9734 W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

PT-2026-60951

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.2.6 SurrealDB versions prior to 2.3.6 SurrealDB versions prior to 2.1.8 SurrealDB versions prior to 3.0.0-alpha.8 Description An authenticated user can bypass network access restrictions in http:: functions. The...

PT-2026-60985

Name of the Vulnerable Software and Affected Versions CartoDB carto-api-client version 0.5.29 Description A remote attack is possible through the manipulation of the column argument within the addFilter function located in the src/filters.ts file. This leads to prototype pollution, which is the...

PT-2026-60966

OpenPLC v3 contains a heap-based buffer overflow in the getData function in webserver/core/modbus master.cpp. getData reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig the function is invoked with the 100-byte...

PT-2026-60931

Name of the Vulnerable Software and Affected Versions halo-dev halo versions prior to 2.24.3 Description A path traversal issue exists in the Files Backup Endpoint component within the Download function of the MigrationEndpoint.java file. This flaw allows a remote attacker to perform manipulation...

CVE-2025-71397: Loop with Unreachable Exit Condition

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions at the root, namespace, or database level to define custom database functions via DEFINE FUNCTION using nested FOR loops. Although a single loop's iteration count is...

PT-2026-60981

Name of the Vulnerable Software and Affected Versions LiuMengxuan04 MiniCode version 0.1.0 Description A flaw in the child process.spawn function within the mcp.ts file allows for remote command injection. Command injection is a security issue where an attacker executes arbitrary operating system...

PT-2026-60972

Name of the Vulnerable Software and Affected Versions zevorn rt-claw versions prior to 0.2.1 Description A server-side request forgery SSRF issue exists in the http request component. Remote exploitation is possible through the manipulation of the url argument within the claw net get and claw net...

CVE-2026-49485

Summary: CVE-2026-49485 affects HAPI FHIR’s FHIRPathEngine (matches(), matchesFull(), replaceMatches()) where user-controlled regex patterns are compiled via Java’s regex engine, enabling ReDoS and CPU exhaustion. The issue exists in implementations prior to version 6.9.9 and 6.9.4.2. An attacker...

CVE-2026-54335 Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the .mergetarget, source utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keyssource. When source was produced by...

CVE-2026-54335 Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__

Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the .mergetarget, source utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keyssource. When source was produced by...