CVE-2026-50768

ImageMaster 9.14.2.8.1 (T-Systems International GmbH) has a file upload flaw in the "add attachments" feature of the create-new-document function, enabling unauthenticated remote arbitrary code execution. CVSS 9.8 critical; SSVC marks exploitation as PoC, automatable, total technical impact. A Po...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099509)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099509 advisory. Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

FreeBSD : PostgreSQL -- Multiple vulnerabilities (05d311bc-9991-11f1-bc50-6cc21735f730)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 05d311bc-9991-11f1-bc50-6cc21735f730 advisory. The PostgreSQL project reports: CVE-2026-6464: psql COPY FROM STDIN, if the copy fails before...

Unity Linux 20.1070e Security Update: gvfs (UTSA-2026-099541)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099541 advisory. A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing...

PT-2026-76816

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.6 Description In the handleException function within lib/setup-sandbox.js, the software fails to sanitize the Error.cause property introduced in ES2022. While the function recursively sanitizes SuppressedError.error,...

CVE-2026-63722

creationtimestamp| type| source ---|---|--- 2026-08-16 15:36:50+00:00| seen| https://gist.github.com/axg11/fc2b86648d8f385b51f4576ff0f392d8 2026-08-21 00:00:08+00:00| published-proof-of-concept| Telegram/87w5sTCGBPeMw8h3c2UBbBkEJEqeSW1iUUAENsR3qsz5w 2026-08-22 05:10:04+00:00| seen|...

MINI-MV8V-CG37-XJ75

Bulletin has no description...

EUVD-2026-59911

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...

CVE-2026-17533

The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network...

CVE-2026-74764

Pandora contains a path traversal vulnerability in its TAR archive extraction functionality. When processing a submitted TAR archive, the extractor passed archive member names directly to Python's tarfile.TarFile.extract without applying an extraction filter. An attacker able to submit a speciall...

CVE-2026-73042

SiYuan before v3.7.4 fails to properly escape database menu metadata in HTML interpolation, allowing stored values to execute script when users open group, view, or field-edit menus. Attackers can inject markup through field descriptions or names that close containing elements and execute arbitra...

CVE-2026-73053

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code...

CVE-2026-73042

SiYuan before v3.7.4 has a vulnerability where database menu metadata is not properly escaped during HTML interpolation. This allows stored values injected via field descriptions or names to close containing elements and trigger script execution when users open group, view, or field-edit menus. T...

MINI-XM4P-GQPC-59GR

Bulletin has no description...

MINI-PG42-CC93-9FV3

Bulletin has no description...

MINI-VX4R-C439-WCRM

Bulletin has no description...

Security Bulletin: This Power System update is being released to address CVE-2026-17100

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the BMC/FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control ove...

Security Bulletin: This Power System update is being released to address CVE-2026-18681

Summary Power Systems Firmware is affected by a vulnerability in the FSP firmware update process. An attacker with authenticated administrator-level access to the FSP can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact...

Security Bulletin: This Power System update is being released to address CVE-2026-16687

Summary Power Systems Firmware is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentialit...