CVE-2026-25687: Race Condition within a Thread

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...

CVE-2026-86348: Incorrect Type Conversion or Cast

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

CVE-2026-90712: Improper Resource Shutdown or Release

A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of the component xAI OAuth Callback Handler. The manipulation of the argument Error leads to denial of service. Remote exploitation of the...

CVE-2026-90708: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3user/yot3pass causes sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-90688: Stack-based Buffer Overflow

A vulnerability was identified in Tenda W20E 15.11.0.610681546841CNTDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely...

CVE-2026-88853: Improper Neutralization of Input During Web Page Generation

Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Affected versions do not distinguish trusted extension configuration from event code...

CVE-2026-90682: Heap-based Buffer Overflow

A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAGGPSLAT/TAGGPSLONG leads to heap-based buffer overflow. An attack has to be...

CVE-2026-90623: Improper Certificate Validation

A weakness has been identified in andreashappe cochise up to 0.4.1. Affected is the function asyncssh.connect of the file src/cochise/sshconnection.py of the component SSH Host Key Handler. Executing a manipulation can lead to improper certificate validation. The attack may be launched remotely...

CVE-2026-90604: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

PT-2026-91238

Mattermost versions =11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenticated user to crash the plugin via a post-action request with an unexpected field type.. Mattermost Advisory ID: MMSA-2026-00701...

PT-2026-91240

Name of the Vulnerable Software and Affected Versions magicblack MacCMS10 version 2026.1000.4055 Description A flaw in the Template Handler component allows remote attackers to perform OS command injection. This occurs through the manipulation of the file...

PT-2026-91203

filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service...

PT-2026-91219

Name of the Vulnerable Software and Affected Versions Dvidelabs flatcc versions prior to 0.6.4 Description A remote attack can trigger a reachable assertion within the Duplicate Symbol Handler component. This issue occurs in the align order members function located in the src/compiler/semantics.c...

CVE-2023-24034

An issue was discovered in twilioajaxhandler.php in Nagios XI before 5.9.3. An attacker can force a user to visit a malicious site by using a open redirect vulnerability...

PT-2026-91246

Name of the Vulnerable Software and Affected Versions Zscaler Client Connector affected versions not specified Description A race condition in the ZPA tunnel handler allows for heap corruption. This can lead to a denial of service, causing the client to crash, or potentially enable arbitrary code...

PT-2026-91454

Name of the Vulnerable Software and Affected Versions PackageKit affected versions not specified Description An authorization flaw exists in PackageKit when using the dnf5 backend. The system skips the polkit authorization check for transactions that include the SIMULATE dry-run flag. However, th...

PT-2026-91059

Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla 3.1.0 - Tabs & Accordions rewrites links matching an item alias into calls to its browser API. The affected renderer places the alias inside a quoted JavaScript argument in a...

PT-2026-91061

Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla 17.0.0 - Modals Pro intentionally supports JavaScript Events such as on-open and on-closed. Affected versions do not distinguish trusted extension configuration from event code...

PT-2026-91045

Name of the Vulnerable Software and Affected Versions Matthias-Wandel jhead versions prior to 3.4 Description A heap-based buffer overflow exists in the WebP EXIF Handler component within the ProcessGpsInfo function of the gpsinfo.c file. This issue occurs when the TAG GPS LAT or TAG GPS LONG...

PT-2026-91158

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf nnrf try old amf discovery fallback of the file src/amf/nnrf-handler.c of the component Old AMF Discovery Fallback. The manipulation of the argument discovery option results in use after free. The attack may ...