EUVD-2026-77220

Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82767

Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82767

CVE-2026-82767 is a cross-site scripting (XSS) vulnerability in SGA1000 , a product associated with CONTEC (as indicated by the vendor security advisory reference). When exploited, an arbitrary script may be executed on a logged-in user's web browser. The attack vector is adjacent network with no...

"YAMAP -Social Trekking GPS App" vulnerable to improper access control

Overview Android application "YAMAP -Social Trekking GPS App" provided by YAMAP INC. contains the following vulnerability: Improper Verification of Source of a Communication Channel CWE-940 - CVE-2026-85125 Koki Sato of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC...

CVE-2026-20683: Improper Authentication

An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account...

CVE-2026-82794: Improper Neutralization of Special Elements used in an OS Command

SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91080

Cross-site scripting vulnerability exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

The vulnerability of the Internal Operations component of the Oracle In-Memory Cost Management for Discrete Industries software allows a hacker to gain unauthorized access to create, delete, or modify protected information.

The vulnerability of the Internal Operations component of the Oracle In-Memory Cost Management for Discrete Industries software solution is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to create, delete, or modify...

PT-2026-91101

The Android application "YAMAP -Social Trekking GPS App" contains an improper access control vulnerability in its WebView implementation. The in-app browser may cause information leakage from the app or redirect users to unintended websites...

PT-2026-91077

Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

PT-2026-91068

Cross-site request forgery vulnerability exists in multiple Contec products. If a user views a specially crafted page while logged in to the affected product, unintended operations may be performed...

PT-2026-91085

Cross-site scripting vulnerability exists in CONPROSYS nano Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

PT-2026-91073

Cross-site scripting vulnerability exists in Contec RP-WAH-SR Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

PT-2026-91758

Name of the Vulnerable Software and Affected Versions DevSpace versions prior to 6.3.22 Description The software fails to reject parent-directory segments in tar entry names originating from the in-pod sync stream. This allows an attacker operating a malicious container to stream tar entries...

PT-2026-91092

Cross-site scripting vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

PT-2026-91075

Cross-site scripting vulnerability exists in Contec EC1000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82796: Improper Neutralization of Input During Web Page Generation

SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91094

Cross-site scripting vulnerability exists in PC-HELPER Wireless I/O DIO-0404RY-LWF and PC-HELPER Wireless I/O DIO-0404RY-LWF-US. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

PT-2026-91067

Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-54247: Allocation of Resources Without Limits or Throttling

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAllr.Body without a size limit. An attacker with...