Fortinet FortiWeb v8.0.1 - Auth Bypass

Titles:Fortinet FortiWeb v8.0.1 - Auth Bypass Author: nu11secur1ty Date: 11/15/2025 Vendor: https://www.fortinet.com/ Software: v8.0.1 Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-64446 Description: CVE-2025-64446 is a critical path traversal vulnerability affecting multiple versions of...

Arbitrary File Upload

Overview unisharp/laravel-filemanager is an A file upload/editor intended for use with Laravel 5 to 6 and CKEditor / TinyMCE. Affected versions of this package are vulnerable to Arbitrary File Upload via the upload process. An attacker can execute arbitrary code by uploading a malicious file usin...

EUVD-2026-19087

A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Impacted is an unknown function of the file /Technostrobe/ of the component Endpoint. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been made public and coul...

CVE-2026-5569

A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Impacted is an unknown function of the file /Technostrobe/ of the component Endpoint. The manipulation results in improper access controls. The attack may be performed from remote. The exploit has been made public and coul...

CVE-2026-5544

A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. The impacted element is an unknown function of the file /goform/formRemoteControl. The manipulation of the argument Profile results in stack-based buffer overflow. The attack can be executed remotely. The exploit h...

Dromara Lamp-Cloud 授权问题漏洞

Dromara Lamp-Cloud is an open-source rapid development platform for microservices, built using Jdk11, SpringCloud, and SpringBoot. Versions of Dromara Lamp-Cloud 5.8.1 and earlier have a licensing issue vulnerability, which stems from improper authorization in the pageUser function...

PT-2026-30457

An information disclosure vulnerability exists in AZIOT 1 Node Smart Switch 16amp- WiFi/Bluetooth Enabled Software Version: 1.1.9 due to improper access control on the UART debug interface. An attacker with physical access can connect to the UART interface and obtain sensitive information from th...

Linux Distros Unpatched Vulnerability : CVE-2026-34095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php,...

CVE-2026-5526

CVE-2026-5526 affects Tenda 4G03 Pro devices (firmware up to 1.0/1.1/04.03.01.53/192.168.0.1). The vulnerability targets an unknown functionality of the /bin/httpd binary, causing improper access controls. Reported as exploitable remotely, with public exploit code available. Multiple connected so...

CVE-2025-68153

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, any authenticated user, machine or controller under a Juju...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +5 more potentially affected by CVE-2026-35442 via directus (>=11.0.0, <=11.16.1)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =34.0.1 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-35442 Source advisory: SNYK:JS-DIRECTUS-15907611...

BELL-CVE-2026-31395

Bulletin has no description...

BELL-CVE-2026-31390

Bulletin has no description...

BELL-CVE-2026-23430

Bulletin has no description...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +5 more potentially affected by CVE-2026-35408 via directus (>=11.0.0, <=11.16.1)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =34.0.1 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-35408 Source advisory: SNYK:JS-DIRECTUS-15907600...

py-strawberry-graphql -- Multiple vulnerabilities

The Strawberry GraphQL project reports: Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a 'connectioninit' handshake has been completed before processing start...

PT-2026-40436

Name of the Vulnerable Software and Affected Versions cPanel affected versions not specified Description Incorrect privileges management and insufficient path filtering in the cpdavd service allow a remote, unauthenticated attacker to read arbitrary files on the server as root. This is achieved...

CVE-2026-34775 Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers...

CVE-2026-34766

CVE-2026-34766 affects Electron; the select-usb-device event callback did not validate the chosen device ID against the filtered device list presented to the handler. This could allow an app to select a device ID outside the renderer’s requested filters or exclusionFilters, potentially granting a...

CVE-2026-34769 Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Ap...