CVE-2026-108815: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/memberdeal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2026-4302)

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility:...

PT-2026-110873

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description Improper privilege management in IBM Db2 for Linux, UNIX, and Windows, including DB2 Connect Server, could allow a local attacker to gain elevated...

PT-2026-110897

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description Improper input validation may allow a local attacker to cause a denial of service. Recommendations At the moment, there is no information about a newer...

PT-2026-110858

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description Remote command injection is possible due to improper processing of the /goform/formAutoFWupgrade endpoint. An attacker can execute arbitrary commands by manipulating the tftpsIP argument. Recommendatio...

PT-2026-111087

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.98.0 Frappe ERPNext versions 16.x prior to 16.6.0 Description Missing input validation in certain endpoints allows remote authenticated attackers to perform SQL injection. By sending specially crafted...

PT-2026-111098

Name of the Vulnerable Software and Affected Versions IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 Description A local attacker can obtain sensitive information because a service account has been assigned excessive permissions. Recommendations At the moment, there is no information...

Medium: docker

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

Important: rpcbind

Issue Overview: A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists,...

Linux net/tipc/bearer ipvlan_hard_header Heap Buffer Overflow

The vulnerability of the ipvlanhardheader function in the net/tipc/bearer.c component of the Linux operating system is related to the pointer being dereferenced after its expiration. Exploitation of this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

PT-2026-110450

Name of the Vulnerable Software and Affected Versions libsamsungtts.so versions prior to SMR Oct-2026 Release 1 Description An out-of-bounds write exists in the libsamsungtts.so library, which allows local attackers to execute arbitrary code. An out-of-bounds write occurs when a program writes da...

PT-2026-110429

Name of the Vulnerable Software and Affected Versions westboy CicadasCMS versions prior to 2431154dac8d0735e04f1fd2a3c3556668fc8dab Description An issue exists in the Template Management component within the TemplateController.input function of the /system/cms/template/input file. Remote...

Important: rpcbind

Issue Overview: A stack-based buffer overflow was found in rpcbind's rpcinfo utility. When querying a remote rpcbind service with rpcinfo -l, address information returned by the server is copied into a fixed-size buffer without sufficient bounds checking. A malicious or compromised rpcbind server...

PT-2026-110800

🚨 CVE-2026-85963 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests,...

PT-2026-110448

Name of the Vulnerable Software and Affected Versions WSM service versions prior to SMR Oct-2026 Release 1 Description A use after free issue exists in the WSM service. This flaw allows local attackers to potentially execute arbitrary code with system privileges. Use after free is a memory...

PT-2026-110494

Name of the Vulnerable Software and Affected Versions tsi-coop tsi-dpdp-cms versions 0.5.0 through 0.5.2 Description A flaw in the JSON Schema Validation component allows remote information disclosure. This occurs through the manipulation of the func argument. Recommendations Upgrade tsi-coop...

PT-2026-110422

Name of the Vulnerable Software and Affected Versions deepseek-ai deepseek-harness versions prior to 0.1.1-rc.2 Description A flaw exists in the spawn function of the Sandbox component. Manipulating the Profile argument allows an attacker to cause a sandbox issue, which can be executed on the loc...

PT-2026-110430

Name of the Vulnerable Software and Affected Versions ngx cache purge versions prior to 3.0.4 Description An issue exists where file deletion is possible via a symlink attack when nginx and a served application, such as WordPress, operate under the same user account. This occurs because the ngx...

PT-2026-110554

Name of the Vulnerable Software and Affected Versions Yungengxin Cloud Billing version 2024.11.28.11 Description A flaw exists in the IOCTL Process Termination component within the LWBilling64.sys library. Specifically, the sub 14000443C function is susceptible to manipulation of the Pid argument...

CVE-2026-105052: Improper Limitation of a Pathname to a Restricted Directory

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...