PT-2026-84055

Name of the Vulnerable Software and Affected Versions RedPort Optimizer wXa-203 versions prior to 20260704 RedPort Optimizer wXa-213 versions prior to 20260704 RedPort Optimizer wXa-223 versions prior to 20260704 Description A command injection issue exists in the System Clock component. A remote...

PT-2026-83671

A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for...

CVE-2026-82620: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseDao.courseranking of the file code/src/dao/CourseDao.java. Performing a manipulation of the argument cno results in sql injection. It is...

PaperCut NG/MF Missing Authentication for Critical Function Vulnerability

PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078...

ROS-20260831-73-0004

The vulnerability of the soapaddxmlref function in the PHP programming language is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2026-83697

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681 B20230703. Impacted is the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument FileName results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public...

PT-2026-83674

A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del pl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public...

PT-2026-83955

A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched...

PT-2026-83700

A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This affects the function CourseDao.course ranking of the file code/src/dao/CourseDao.java. Performing a manipulation of the argument cno results in sql injection. It is...

PT-2026-83975

A vulnerability was detected in sdcb chats up to 1.12.0. This affects the function McpController of the file src/BE/web/Controllers/Users/Mcps/McpController.cs of the component fetch-tools Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The...

PT-2026-84032

Name of the Vulnerable Software and Affected Versions QuantumNous new-api versions prior to 1.0.0-rc.17 Description A remote manipulation of the Revoked API Token Handler component within the '/api/usage/token/' endpoint can lead to session expiration. Recommendations Upgrade to version 1.0.0-rc....

CVE-2026-82833: Improper Access Control

A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. Affected by this issue is the function ExampleDetail of the file /v1/projects/1/examples/ of the component...

PT-2026-83777

Name of the Vulnerable Software and Affected Versions diem-project diem versions prior to 5.1.4 Description An OS command injection flaw exists in the Administrative Console component. A remote attacker can exploit this by manipulating the dm command argument passed to the executeCommand function...

CVE-2026-82595: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the atta...

CVE-2026-82608

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get4bytes of the file src/modules/imsregistrarscscf/cxdxavp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has bee...

CVE-2026-82668: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the function getDefaultBranch of the file src/SCM/System/Git/CommandLine.php of the component Git Command Line. Such manipulation leads to os command injection. The attack can be executed...

CVE-2026-82820: Heap-based Buffer Overflow

A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amfstringnew of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made publi...

PT-2026-83956

A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amf string new of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made...

CVE-2026-82667: Server-Side Request Forgery (SSRF)

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpointurl leads to server-side request forgery. It is possibl...

PT-2026-83776

Name of the Vulnerable Software and Affected Versions valkey-io valkey version 9.1.0 Description A double free issue exists in the Module Timer Subsystem within the moduleTimerHandler function located in the src/module.c file. This flaw allows a remote attacker to trigger a double free, which...