CVE-2026-68062

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

EUVD-2026-65310

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

CVE-2026-68959

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability caused by an incomplete fix for CVE-2024-41726. An attacker who can log in to a Windows system with the affected product installed may execute arbitrary code on another Windows system that also has the product install...

CVE-2026-68959

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

EUVD-2026-65309

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

CVE-2026-68062

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability resulting from an incomplete fix for CVE-2024-41726 . An attacker who can log in to a Windows system with the affected product installed may be able to execute arbitrary code on another Windows system that has the pro...

CVE-2026-68062

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected...

EUVD-2026-65195

Adminer 4.6.0 through 5.5.0 fixed in 5.5.1 contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability GHSA-8478-xrj3-h9c2. The validation guard bootstrap.inc.php only rejects prefixes matching ^/^/, blocking //evil.com but allowing values such as /\evil.com whose second character is ...

CVE-2026-16434

Adminer versions 4.6.0 through 5.5.0 contain an incomplete fix for a prior X-Forwarded-Prefix header injection (GHSA-8478-xrj3-h9c2). The validation guard in bootstrap.inc.php uses the regex ^/[^/] to reject malicious prefixes, which blocks //evil.com but allows values like /\evil.com where the s...

PT-2026-81878

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.20 through 11.0.24 Apache Tomcat versions 10.1.53 through 10.1.57 Apache Tomcat versions 9.0.115 through 9.0.120 Description Improper input validation occurs due to an incomplete fix for a previous issue...

CVE-2026-72585-PoC

CVE-2026-72585 — Grafana: Correzione incompleta di CVE-2026-21724 consente al ruolo Editor di eliminare i contact point protetti Prodotto: Grafana Grafana Labs — fino alla 13.2.0 File: pkg/services/ngalert/provisioning/contactpoints.go CWE: CWE-284 — Controllo degli accessi improprio CVSS 3.1:...

CVE-2026-19685

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

CVE-2026-19685

NetworkManager failed to enforce the private_user restriction on the 802-1x.ca-path and phase2-ca-path directory-valued connection properties—an incomplete fix for CVE-2025-9615. An unprivileged local user can point a private WPA-Enterprise (802.1X) profile's CA path at an attacker-controlled dir...

EUVD-2026-64957

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

CVE-2026-19685 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

CVE-2026-76844

webpack-dev-middleware suffers from a path traversal vulnerability in its getFilenameFromUrl function, an incomplete fix for CVE-2024-29180 . When publicPath is configured without a trailing slash, a crafted request (e.g., GET /assets../.env against publicPath /assets) bypasses the UP_PATH_REGEXP...

EUVD-2026-64850

webpack-dev-middleware resolves a request to a local file in getFilenameFromUrl by testing the request pathname against a traversal guard and then slicing it at a fixed character offset. The guard, UPPATHREGEXP applied to path.normalize./$pathname, only matches ".." that stands as a whole path...

aapanel-ws-bypass

aaPanel: i vendor non sempre correggono le cose correttamente Una correzione incompleta per CVE-2021-37840 espone ancora 3,6 milioni di server a RCE come root, 5 anni dopo Scoperto da: EON Security CVE: Assegnazione in sospeso CVSS: 8.8 Alto — AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Interessati:...

CVE-2026-78205

BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...

EUVD-2026-64680

BentoML's outbound connection safeguard makesafeconnect in internal/utils/uri.py blocks private, loopback, and link-local IP addresses but fails to reject the RFC 6598 shared address space 100.64.0.0/10, CGNAT. In versions 1.4.19 through 1.4.39, an unauthenticated attacker can supply URLs pointin...