CVE-2026-94491

Yonyou KSOA 9.0 contains a SQL injection vulnerability in the file /cardcase/search_list.jsp , triggered by manipulating the address argument. The attack can be launched remotely without authentication (CVSS 3.1 score: 7.3 , HIGH). The vendor was contacted but did not respond , and no official pa...

CVE-2026-94491 Yonyou KSOA search_list.jsp sql injection

A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...

CVE-2026-94491: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...

PT-2026-97017

Name of the Vulnerable Software and Affected Versions Spree versions 5.4.0 through 5.4.3 Spree versions 5.5.0 through 5.5.3 Description An authenticated customer can associate an eligible guest cart with their own account and access the billing and shipping address data stored within that cart...

PT-2026-96327

Name of the Vulnerable Software and Affected Versions Yonyou KSOA version 9.0 Description A weakness in the /cardcase/search list.jsp file allows for remote SQL injection. This occurs when the address argument is manipulated, enabling an attacker to execute unauthorized database queries...

PT-2026-96838

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.15.2 Description A DNS rebinding issue exists in the safe Axios request interceptor located in packages/service/common/api/axios.ts. The system validates a hostname using the isInternalAddress function before the HT...

CVE-2026-93012 Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe

Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in sendmailpipe. On MSWin32 the envelope sender and every recipient go into a single command string, which open passes to a...

CLSA-2026-1790006158 TuxCare security update for ip-address (1 CVE)

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.3...

PT-2026-96170

Name of the Vulnerable Software and Affected Versions Email::Sender::Transport::Sendmail versions prior to 2.602 Description On Windows MSWin32, the software allows arbitrary command execution when sending a message with an envelope address that reaches the shell via the sendmail pipe function...

PT-2026-105284

TuxCare rebuilt ip-address to address 1 CVE. Fixed in 6.4.0-tuxcare.3...

CVE-2026-86551

The Z80Ultra NX741J product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factorymacaddress in the Settings.Secure database...

EUVD-2026-83644

The Z80Ultra NX741J product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factorymacaddress in the Settings.Secure database...

CVE-2026-86551

The ZTE Z80Ultra (NX741J) smartphone is affected by an information disclosure vulnerability in the Settings.Secure database . Non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address , which is not properly restricted from unprivileged access....

CVE-2026-86551 Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product

The Z80Ultra NX741J product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factorymacaddress in the Settings.Secure database...

CVE-2026-86551 Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product

The Z80Ultra NX741J product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factorymacaddress in the Settings.Secure database...

SUSE CVE-2025-8041

In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141...

CVE-2026-86551: Exposure of Resource to Wrong Sphere

The Z80Ultra NX741J product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factorymacaddress in the Settings.Secure database...

PT-2026-95897

Name of the Vulnerable Software and Affected Versions Z80Ultra NX741J affected versions not specified Description Non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory mac address in the Settings.Secure database. Recommendations At the moment, there is...

CVE-2026-86814

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can asse...

SUSE CVE-2026-89984

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix kernel address leakages in LBR stack Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space...