CVE-2026-91001

A stack-based buffer overflow exists in the D-Link DI-8400 (firmware 16.07 ) in the function ddns_asp of the file /ddns.asp , part of the DDNS Configuration component. Manipulating the arguments serv , user , host , wild , mx , bmx , cust , or ip triggers the overflow. The attack can be initiated...

CVE-2026-88617

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges...

CVE-2026-52826: Improper Authorization

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/id/rate/rate, /en/admin/customer/id/rate/rate, and /en/admin/activity/id/rate/rate independently resolve the authorized parent identifier and the attacker-selected child rate identifier...

CVE-2026-73437: Insufficient Verification of Data Authenticity

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to...

PT-2026-92705

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Configuration Tools. Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Siebel CRM Development. Successf...

Oracle Linux 9 : ELSA-2026-67133-0: / firefox (ELSA-2026-671330)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-671330 advisory. 140.15.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding...

CVE-2026-52821: Authorization Bypass Through User-Controlled Key

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/project and /en/admin/project/create/customer require only the generic createactivity or createproject capability and do not verify edit access to the supplied Project or Customer...

CVE-2026-76867: Improper Neutralization of Input During Web Page Generation

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routingtabaddcgi, routingtablelistshowcgi, routepolicyaddcgi, and routepolicyparameshowcgi. Attackers can inject persistent script payloads...

CVE-2026-76706: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could result in the disclosure of security-relevant configuration details and security feature status, whic...

CVE-2026-88617: Incorrect Authorization

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges...

CVE-2026-76159: Incorrect Permission Assignment for Critical Resource

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file...

PT-2026-93192

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns wan list show.cgi caused by unsafe eval handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewe...

PT-2026-93190

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan config set cgi, wan num set cgi, and lan ip change cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network...

PT-2026-92466

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Orchestrator affected versions not specified Description An issue in the API endpoint allows an unauthenticated remote attacker to obtain sensitive information. This could lead to the disclosure of...

PT-2026-92034

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges...

PT-2026-92025

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection. For configuration details, see ...

PT-2026-91899

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITYSYSTEM via an attacker-controlled preload.json file...

PT-2026-92395

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activate files action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...

CVE-2026-91001: Stack-based Buffer Overflow

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddnsasp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiate...

CVE-2026-83182: Improper Access Control

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Configuration Tools. Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via SQL to compromise Siebel CRM Development. Successf...