PT-2026-67516

Name of the Vulnerable Software and Affected Versions Emlog CMS versions prior to 2.6.15 Description A stored cross-site scripting XSS issue exists in the article publishing module at the '/admin/article.php' endpoint. A remote authenticated attacker can inject arbitrary JavaScript code through t...

PT-2026-67146

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT LENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

PT-2026-85354

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vh22-h7hf-www7. This link is maintained to preserve external references. Original Description SiYuan versions = v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL stateme...

CVE-2026-16060: Unrestricted Upload of File with Dangerous Type

The Insert or Embed Articulate Content into WordPress plugin through 4.3000000027 does not correctly validate the contents of an uploaded archive, relying on a bypassable check that lets an Editor-level user upload a server-executable file into a public directory, resulting in remote code executi...

CVE-2026-52520: Improper Neutralization of Input During Web Page Generation

Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...

CVE-2026-67617: Improper Neutralization of Input During Web Page Generation

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

CVE-2026-18645: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function addcontent of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. Th...

PT-2026-67013

Name of the Vulnerable Software and Affected Versions nltk version 3.9.4 Description The nltk.downloader.Downloader. download package function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with t...

PT-2026-76194

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

TrainShield: Targeted Awareness for Cybersecurity Training

In recent years, cybersecurity threats have increasingly exploited human behaviour rather than purely technical vulnerabilities, exposing the limits of traditional awareness programmes delivered outside real-world contexts. To bridge this gap, we introduce TrainShield, an interaction paradigm for...

PT-2026-67090

Name of the Vulnerable Software and Affected Versions The Contest Gallery WordPress plugin versions prior to 30.0.7 Description Insufficient per-object capability and nonce checks in a post-deletion handler allow users with Author-level permissions or higher to permanently delete arbitrary posts,...

PT-2026-76196

GNU Wget through 1.25.0, fixed in commit 43d3ba9, contains an integer overflow vulnerability in the parse content range function within src/http.c that allows server-controlled values to cause signed integer arithmetic to overflow. Attackers can supply malicious Content-Range header values to...

CVE-2026-69086: Improper Limitation of a Pathname to a Restricted Directory

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish...

PT-2026-67444

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-69149: Improper Neutralization of Input During Web Page Generation

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting XSS vulnerability exists in @angular/platform-server's DOM emulation dependency domino when serializing...

CVE-2026-16563: Improper Access Control

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

PT-2026-85335

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-36v8-mpjm-8j5r. This link is maintained to preserve external references. Original Description SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content...

PT-2026-67534

Name of the Vulnerable Software and Affected Versions Camaleon CMS versions prior to 2.9.3 Description A missing authorization issue exists on the 'drafts' endpoint. This allows an authenticated user with low privileges to bypass role and permission checks and create draft posts. By using only...

CVE-2026-67972

An issue in the CFCFDPRecvMd component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an information disclosure...

Linux Distros Unpatched Vulnerability : CVE-2026-69149

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, a...