CVE-2025-13778

The CVE-2025-13778 entry concerns ABB AWIN GW100 rev.2 and AWIN GW120 systems, identified by missing authentication for a critical function. Affected revisions include GW100 rev.2: 2.0-0, 2.0-1; GW120: 1.2-0, 1.2-1. The vulnerability’s impact is indicated as HIGH availability risk (CVSS 4.0: AV:A...

The vulnerability of the `scrub_find_fill_first_stripe()` function in the `fs/btrfs/scrub.c` file of the btrfs file system in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the scrubfindfillfirststripe function in the fs/btrfs/scrub.c file of the btrfs file system in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-32304

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the createfunctionargs, code function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from...

The vulnerabilities of the functions `lock_pages()` and `privcmd_ioctl_dm_op()` in the `drivers/xen/privcmd.c` module of the Linux kernel device driver framework allow a attacker to cause a service failure.

The vulnerabilities of the functions lockpages and privcmdioctldmop in the drivers/xen/privcmd.c module of the Linux kernel device driver for page buffer management are related to the use of pointers. Exploiting these vulnerabilities could allow a remote attacker to cause service interruptions...

CVE-2026-3698

A vulnerability was identified in UTT HiPER 810G up to 1.7.7-171114. This affects the function strcpy of the file /goform/NTP. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used...

Arbitrary Code Injection

Amendment This was deemed not a vulnerability. Overview es-toolkit is an A state-of-the-art, high-performance JavaScript utility library with a small bundle size and strong type annotations. Affected versions of this package are vulnerable to Arbitrary Code Injection. The template function in...

CVE-2026-3741

A security vulnerability has been detected in YiFang CMS 2.0.5. The affected element is the function update of the file app/db/admin/DfriendLink.php. Such manipulation of the argument linkName leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed...

PT-2026-23948

A vulnerability was detected in YiFang CMS 2.0.5. The impacted element is the function update of the file app/db/admin/D singlePage.php. Performing a manipulation of the argument Title results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and m...

EUVD-2026-9101

Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2...

SIMPLE.ERP SQL注入漏洞

SIMPLE.ERP is an e-commerce platform provided by the SIMPLE company. Versions of SIMPLE.ERP prior to [email protected] contained a SQL injection vulnerability. This vulnerability stemmed from the lack of input validation in the search function, which could lead to SQL injection attacks...

PT-2026-21902

Name of the Vulnerable Software and Affected Versions ePati Cyber Security Technologies Inc. Antikor Next Generation Firewall NGFW versions prior to 2.0.1301 Description A missing authentication check for a critical function in the Antikor Next Generation Firewall NGFW allows an attacker to bypas...

CVE-2026-2548

A flaw has been found in WAYOS FBM-220G 24.10.19. This affects the function sub40F820 of the file rc. Executing a manipulation of the argument upnpwaniface/upnpssdpinterval/upnpmaxage can lead to command injection. The attack can be executed remotely. The vendor was contacted early about this...

EUVD-2026-5775

A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub420618 of the file /goform/setupnp. This manipulation of the argument upnpenable causes os command injection. Remote exploitation of the attack is possible. The exploit has been made available to...

EUVD-2026-5759

A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/user/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclos...

The vulnerability of the ffs_func_eps_enable() function in the drivers/usb/gadget/function/f_fs.c file of the Linux operating system’s USB gadget driver kernel allows a hacker to cause a service failure.

The vulnerability of the ffsfuncepsenable function in the drivers/usb/gadget/function/ffs.c file of the Linux device driver framework is related to pointer manipulation. Exploiting this vulnerability could allow a malicious actor to cause service failure remotely...

CVE-2026-21532

Azure Function Information Disclosure Vulnerability...

CVE-2025-65875

An arbitrary file upload vulnerability in the AddFont function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via uploading a crafted PHP file...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Split function. An attacker can cause excessive CPU consumption and resource exhaustion by supplying a malicious APK stream that triggers unbounded gzip inflation. Remediation...

CVE-2026-20711

Cross-site scripting vulnerability exists in E-mail function of Cybozu Garoon 5.0.0 to 6.0.3, which may allow an attacker to reset arbitrary users’ passwords...

The vulnerability of the system() function (/boaform/formSysCmd) in the Tenda HG10 optical network terminal software allows a hacker to execute arbitrary commands.

The vulnerability of the system function /boaform/formSysCmd in the microprogramming software for Tenda HG10 optical network terminals is related to the lack of measures taken to neutralize special elements during the processing of the sysCmd parameter. Exploiting this vulnerability allows a remo...