CVE-2026-90881 D-Link DIR-882 CGI Binary dllog.cgi main information disclosure

A weakness has been identified in D-Link DIR-882 up to 20260814. Impacted is the function main of the file /HNAP1/dllog.cgi of the component CGI Binary. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the...

CVE-2026-90858

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function sessionstart of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The...

CVE-2026-90852

luben zstd-jni (a Java binding for the Zstandard compression library) is affected by a use-after-free vulnerability in the Dictionary Sharing component, specifically in the function ZstdCompressCtx.loadDict within ZstdCompressCtx.java. Affected versions are up to 1.5.7-13 . The vulnerability can ...

PT-2026-92177

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

PT-2026-92116

OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file in the application's working directory. The application passes the user-controll...

CVE-2026-55690: Improper Neutralization of Input During Web Page Generation

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedServiceFactory::newFromName in includes/EmbedService/EmbedServiceFactory.php interpolates an...

CVE-2026-57141: Improper Control of Generation of Code

PraisonAI is a multi-agent teams system. Prior to 1.7.2, the codeMode tool in src/praisonai-ts/src/tools/builtins/code-mode.ts executes model-generated JavaScript with new Function and withsandbox, while a regular-expression blocklist can be bypassed with Function'return this' to recover the glob...

PT-2026-93169

Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafted URL containing shell metacharacters to the server.open configuration on macOS. The openBrowser function in packages/core/src/server/open.ts passes the URL...

TrueConf Server < 5.3.9.10013 / 5.4.9.10018 / 5.5.5.10010 Multiple Vulnerabilities

The version of TrueConf Server installed on the remote host is prior to 5.3.9.10013, 5.4.9.10018, or 5.5.5.10010. It is, therefore, affected by multiple vulnerabilities: - A remote unauthenticated attacker connecting to TrueConf Server over 4307/TCP can invoke an undocumented critical function an...

CVE-2026-88620

The SmartAdmin API running on Java17 SpringBoot3 version 3.30.0 is affected by an improper authorization vulnerability in the /employee/queryAll endpoint. The root cause is a failure to enforce necessary function-level permissions or data-scope authorization . Consequently, an authenticated low-p...

ROS-20260915-73-0203

The vulnerability of the epfree function in the eventpoll.c component of the Linux kernel’s operating system is related to the dereferencing of a pointer whose expiration time has passed. Exploiting this vulnerability could allow an attacker to trigger a service failure...

ROS-20260915-73-0147

The vulnerability of the epremove function in Linux operating system kernels relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

PT-2026-93119

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

USN-8758-1: dracut vulnerability

It was discovered that dracut did not properly shell-quote messages written by the die function to the emergency hook directory. An attacker on the adjacent network controlling a rogue DHCP server could use this issue to inject commands that execute as root during boot-failure handling...

rsync: rsync: Denial of Service via Algorithmic Complexity

A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the hashsearch function by sending a specially crafted file list. This can lead to the exhaustion of the receiver's CPU resources, causing a sustained denial of service DoS...

rsync: rsync: Heap Out-of-Bounds Write via crafted argument list

A flaw was found in rsync. A remote attacker could exploit an out-of-bounds write vulnerability in the readargs function by sending a specially crafted argument list. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code...

rsync: rsync: Heap Out-of-Bounds Write via crafted argument list

A flaw was found in rsync. A remote attacker could exploit an out-of-bounds write vulnerability in the readargs function by sending a specially crafted argument list. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code...

rsync: rsync: Denial of Service via Algorithmic Complexity

A flaw was found in rsync. A remote attacker can exploit an algorithmic complexity vulnerability within the hashsearch function by sending a specially crafted file list. This can lead to the exhaustion of the receiver's CPU resources, causing a sustained denial of service DoS...

CVE-2026-82035

A flaw was found in PyMuPDF. This path traversal vulnerability exists in the extractobjects function, specifically within the font branch. A remote attacker can exploit this by providing a specially crafted PDF, EPUB, XPS, or FB2 file. The vulnerability allows the attacker to use encoded path...

CVE-2026-54182

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. Prior to 4.1.70, 5.6.2, 6.8.13, and 7.0.36, Backpack\CRUD\Stats::makeCurlRequest in src/Stats.php is reached from...