CVE-2026-101008: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function mergesplitfile of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument splitfilepath results in command injection. The attack is possible to be...

PT-2026-99784

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description An OS command injection flaw exists in the Unzip Handler component. A remote attacker can exploit this by manipulating the Password argument within the panelTask.bt task. unzip function locate...

PT-2026-99915

Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102 Description A flaw in the boa temp Handler component allows remote attackers to bypass authentication. This issue occurs within the process request function, enabling unauthorized access to be carried out...

CVE-2026-101077: Missing Authentication for Critical Function

A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function processrequest of the component boatemp Handler. This manipulation causes missing authentication. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contact...

CVE-2026-101075: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /locationtime.cgi of the component Location Time Handler. The manipulation of the argument mac leads to os command injection. Remote exploitation of the attack is...

PT-2026-99847

Name of the Vulnerable Software and Affected Versions refly-ai refly versions prior to 1.1.1 Description An issue exists in the JWT Token Handler component within the file apps/api/src/modules/config/app.config.ts. Manipulation of the test input can lead to the exposure of hard-coded credentials,...

CVE-2026-101002: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/networktools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. Th...

CVE-2026-101076: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was detected in Netcore NR289-GE 1.4.5102. This affects the function system of the file /setntpserverip.cgi of the component CGI Handler. The manipulation of the argument ntpip results in os command injection. The attack can be executed remotely. The exploit is now public and may ...

CVE-2026-100891: Encoding Error

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is the function opendmarcpolicyquerydmarc in the library libopendmarc/opendmarcpolicy.c of the component Internationalized Domain Name Handler. Such manipulation leads to encoding error. It is...

CVE-2026-101009: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bttask.unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to os command injection. The attack...

PT-2026-99783

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description A command injection issue exists in the File Merge Handler component within the merge split file function located in the /www/server/panel/class/files.py file. A remote attacker can exploit th...

CVE-2026-101204: Out-of-bounds Read

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure bu...

CVE-2026-101015: Improper Validation of Unsafe Equivalence in Input

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is some unknown functionality of the file policy.c of the component Domain Handler. Executing a manipulation can lead to improper validation of unsafe equivalence in input. The attack may be launched...

CVE-2026-101007: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2026-54710: Improper Input Validation

FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution RCE vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the server with the privileg...

CVE-2026-101132: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2. The affected element is the function loadProfile of the file packages/boot/app-boot/src/profile.ts of the component Bundle Patch Handler. The manipulation of the argument dsh.bundle.patch results in path traversal...

PT-2026-99807

Name of the Vulnerable Software and Affected Versions Trusted Domain Project OpenDMARC versions prior to 1.4.3 Description A flaw exists in the Domain Handler component within the policy.c file. A remote attacker can perform a manipulation that leads to improper validation of unsafe equivalence i...

PT-2026-99772

Name of the Vulnerable Software and Affected Versions aaPanel BaoTa versions prior to 11.8.1 Description An OS command injection flaw exists in the Database Backup Handler component. The issue occurs within the InputSql function located in the class/database.py file. A remote attacker can exploit...

PT-2026-99907

Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102 Description An OS command injection flaw exists in the Location Time Handler component. The issue occurs when the mac argument is manipulated within the system function of the '/location time.cgi' endpoint,...

CVE-2026-101000: Missing Authorization

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the...