CVE-2026-14683

A flaw was found in HdrHistogram. A local attacker can exploit a vulnerability in the decodeFromCompressedByteBuffer function by manipulating the lengthOfCompressedContents argument. This manipulation leads to uncontrolled memory allocation, which can result in a Denial of Service DoS condition,...

CVE-2026-15525

CVE-2026-15525 affects the kLOsk adloop package up to version 0.9.0. The vulnerability is in the function _validate_urls in src/adloop/ads/write.py, where manipulating the argument final_url can trigger a server-side request forgery (SSRF). The issue can be exploited remotely and the exploit is p...

CVE-2026-15518

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulation of the argument qqfilename leads to...

EUVD-2026-43260

A vulnerability has been found in AREA 17 Twill CMS up to 3.6.0. The impacted element is the function FileLibraryController::storeFile of the file src/Http/Controllers/Admin/FileLibraryController.php of the component Media Library Insert Page. Such manipulation of the argument qqfilename leads to...

EUVD-2026-43248

A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown function of the file /app/Policies/ of the component Policy Handler. Performing a manipulation results in missing authorization. Remote exploitation of the attack is possible. The exploit is now...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the saveSetting function of the API component. An attacker can gain unauthorized access to sensitive information or modify application settings by sending crafted API requests with insufficient authorization...

PT-2026-57616

Name of the Vulnerable Software and Affected Versions pyod versions 3.5.0 through 3.5.2 Description A deserialization flaw exists in the pyod.utils.persistence.load function within the pyod/utils/persistence.py file. The issue occurs because joblib.load is executed before any envelope validation,...

PT-2026-57921

A vulnerability was detected in tanstack db up to 0.6.8. Affected by this vulnerability is the function select of the file src/query/compiler/select.ts of the component Alias Path Handler. The manipulation results in improperly controlled modification of object prototype attributes. The attack ma...

ROS-20260713-73-0013

The vulnerability is related to insufficient validation of input data and incorrect implementation of functions. Exploiting this vulnerability can allow an attacker to cause service failures...

PT-2026-59577

Summary The web crawl function in praisonaiagents/tools/web crawl tools.py accepts arbitrary URLs from AI agents with zero validation. No scheme allowlisting, hostname/IP blocklisting, or private network checks are applied before fetching. This allows an attacker or prompt injection in crawled...

PT-2026-59696

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing component. The parse op part function in query.py uses the unsafe eval function to dynamically evaluate user-supplied query operands without proper sanitization or restriction. Althoug...

PT-2026-59582

Summary The URL checking logic in PraisonAI has a logical flaw that could be bypassed by attackers, leading to SSRF attacks. Details The current PraisonAI project uses validate url to validate the input URL. The main logic is to perform security checks on the host portion of the URL extracted by...

PT-2026-59299

A vulnerability was found in Mindinventory MindSQL up to 0.2.1. Impacted is the function ask db of the file mindsql/core/mindsql core.py. Performing a manipulation results in code injection. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was...

CVE-2026-39042

An issue in MikroTIk SIA Mikrotikls, Latvia RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 allows a remote attacker to cause a denial of service via the unflatten function in libumsg.so...

Linux kernel tap_get_user() Buffer Overflow

The vulnerability of the tapgetuser function in the drivers/net/tap.c file of the Linux kernel network device driver is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected informati...

Linux kernel mmap DoS

The vulnerability of the dlfb ops mmap function in Linux kernel relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

Wavlink WL-NU516U1 USB Printer Command Execution

The vulnerability of the usbp910 function in the /cgi-bin/adm.cgi script of the Wavlink WL-NU516U1 wireless USB printer software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow an attacker to execute arbitrary commands remotel...

neovim View Branch Code Execution

The vulnerability of the M.read function in the neovim text editor’s View Branch component is related to the lack of measures taken to clean up data at the control level. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2026-40469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow vulnerability has been found in builtin.c program file of gawk dosub routine. This issue could be used to overwrite gawk heap metadata and...

CVE-2026-39042

A vulnerability in MikroTik RouterOS (versions 7.21.x before v.7.21.4 and 7.22.x before v.7.22.2 ) allows a remote attacker to cause a denial of service . The root cause is located in the unflatten() function within the libumsg.so library. While the vulnerability is confirmed, no specific exploit...