PT-2026-91024

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read model of the file fedml/core/distributed/communication/s3/remote storage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3 key str causes...

PT-2026-91444

Name of the Vulnerable Software and Affected Versions cosmicstack-labs mercury-agent versions prior to 1.1.14 Description A flaw in the GitHub API Handler component allows remote exploitation via server-side request forgery SSRF, a technique where an attacker induces the server to make requests t...

PT-2026-91250

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf node unregister of the file scenegraph/base scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be...

PT-2026-91445

Name of the Vulnerable Software and Affected Versions FFmpeg versions 4.4.6 and earlier FFmpeg versions 5.1.8 and earlier FFmpeg versions 6.1.4 and earlier FFmpeg versions 7.1.3 and earlier FFmpeg versions 8.0.1 and earlier Description A remote attack can trigger an out-of-bounds read within the...

PT-2026-91136

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made publi...

CVE-2026-90704: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made publi...

CVE-2026-90604: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

PT-2026-91414

CISA confirms active exploitation of CVE-2025-0268—a perfect-10 GitLab bug attackers are hitting before most admins have patched. If your threat model assumes you have time to deliberate, you're already breached. Patch velocity is now survival. CyberSecurity DevSecOps...

CVE-2026-90614: Deserialization of Untrusted Data

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.readmodel of the file fedml/core/distributed/communication/s3/remotestorage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3keystr causes...

CVE-2026-90790: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

PT-2026-91249

Name of the Vulnerable Software and Affected Versions a2aproject a2a-python versions prior to 1.1.4 Description A server-side request forgery issue exists in the Push Notification Sender component. The problem occurs within the dispatch notification function located in the src/a2a/server/tasks/ba...

CVE-2026-90693: Stack-based Buffer Overflow

A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible...

PT-2026-91173

A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of the component xAI OAuth Callback Handler. The manipulation of the argument Error leads to denial of service. Remote exploitation of the...

CVE-2026-90814: Server-Side Request Forgery (SSRF)

A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of...

The vulnerability of the Adobe Experience Manager content and media management system, related to deficiencies in authentication procedures, allows a perpetrator to execute arbitrary code.

The vulnerability of the Adobe Experience Manager content and media management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of Microsoft Discovery Studio’s research environment arises from the improper elimination of special elements in data queries, allowing an intruder to disclose protected information.

The vulnerability of the Microsoft Discovery Studio research environment is related to the improper elimination of special elements in data queries. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose protected information...

The vulnerability of the Service Manager component in the Oracle GoldenGate data flow management tool allows a hacker to gain full control over the application.

The vulnerability of the Service Manager component in the Oracle GoldenGate data flow management tool is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTP network protoc...

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms lies in the absence of authentication procedures, which allows attackers to compromise the integrity and accessibility of protected information.

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to compromise the integrity and accessibility of protected information from a remote location...

The vulnerability in the API for handling email addresses of Git repository managers like Gitea allows attackers to increase their privileges.

The vulnerability in the API for handling email addresses of Git repositories managed by Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

The vulnerability of SAP Business One’s resource management system, which exists due to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of SAP Business One’s resource management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...