CVE-2026-40456 OS Command Injection in LMS

An OS Command Injection vulnerability exists in LMS LAN Management System before commit 9fcb4de due to an IP address parameter being passed to the "exec" function without proper validation, allowing attackers to execute arbitrary operating system commands...

EUVD-2026-37875

An OS Command Injection vulnerability exists in LMS LAN Management System before commit 9fcb4de due to an IP address parameter being passed to the "exec" function without proper validation, allowing attackers to execute arbitrary operating system commands...

CVE-2026-40456

An OS Command Injection vulnerability exists in LMS LAN Management System before commit 9fcb4de due to an IP address parameter being passed to the "exec" function without proper validation, allowing attackers to execute arbitrary operating system commands...

CVE-2026-11784

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replacefile function. This makes it...

EUVD-2026-37848

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replacefile function. This makes it...

CVE-2026-12407 E2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screenaction function lacking a dedicated capability check and nonce verification — when invoked via the ?action=screen routing path...

HdrHistogram: HdrHistogram: Denial of Service via uncontrolled memory allocation

A flaw was found in HdrHistogram. A local attacker can exploit a vulnerability in the decodeFromCompressedByteBuffer function by manipulating the lengthOfCompressedContents argument. This manipulation leads to uncontrolled memory allocation, which can result in a Denial of Service DoS condition,...

Missing Authentication for Critical Function

Overview windows-mcp is a Lightweight MCP Server for interacting with Windows Operating System. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the HTTP transport process when authentication is not enforced and wildcard CORS is enabled. An...

PT-2026-50802

Name of the Vulnerable Software and Affected Versions M365 Copilot affected versions not specified Description A missing authentication flaw in a critical function allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no information about ...

CVE-2026-38714

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 (including earlier versions) are susceptible to a command injection vulnerability within the Python configuration function . A remote attacker can exploit this by providing crafted input to execute arbitrary commands with root privileges...

ROS-20260618-73-0004

The vulnerability of the BilateralBlurImage method in the AcquireBilateralTLS function of the ImageMagick console graphics editor is related to the release of an incorrect pointer. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

PT-2026-61769

Name of the Vulnerable Software and Affected Versions PraisonAI versions 3.9.24 through 4.6.57 Description Server-Side Request Forgery SSRF is possible in the SpiderTools.scrape page function, which is also utilized by extract links, crawl, and extract text. While the software validates the initi...

CVE-2026-38716

InHand Networks IR912 and IR915 (versions V1.0.0.r20042 and earlier) are susceptible to a command injection vulnerability within the Python application export function . This flaw allows remote attackers to execute arbitrary commands as root by providing crafted input. Exploitation details are no...

CVE-2026-9692: Generation of Predictable Numbers or Identifiers

Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, the heap address of an anonymous hash, and the PID. These are predictable or low-entropy...

PT-2026-50699

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 including earlier versions were discovered to contain a command injection vulnerability in the Python application export function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input...

EUVD-2026-37919

InHand Networks IR912 V1.0.0.r20042 and IR915 V1.0.0.r20042 including earlier versions were discovered to contain a command injection vulnerability in the Python application export function. This vulnerability allows remote attackers to execute arbitrary commands as root via a crafted input...

The vulnerability of SAP software integration platforms such as SAP NetWeaver AS ABAP and SAP NetWeaver ABAP allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of SAP software integration platforms such as SAP NetWeaver AS ABAP and SAP NetWeaver ABAP is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and...

The vulnerability of the tcf_pedit_act() function in the act_pedit module of Linux kernel allows a hacker to trigger a service failure or enhance their privileges.

The vulnerability of the tcfpeditact function in the actpedit module of Linux kernel systems is related to writing beyond buffer boundaries. Exploiting this vulnerability can allow an attacker to cause system failures or gain increased privileges...

PT-2026-61792

Name of the Vulnerable Software and Affected Versions PraisonAI versions 1.4.0 through 1.7.1 Description The codeMode function in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript using new Function within a withsandbox block. The system relies on a limited source-cod...

PT-2026-50629

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace file function. This makes i...