PT-2026-103625

Name of the Vulnerable Software and Affected Versions AJA HELO Plus versions prior to 2.1.7 Description A stored cross-site scripting issue exists that allows unauthenticated attackers with network access to inject malicious JavaScript. This occurs when the eParamID SystemName variable is set wit...

CVE-2026-102136: Improper Neutralization of CRLF Sequences

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...

CVE-2026-102111: Improper Validation of Specified Quantity in Input

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative...

CVE-2026-102124: Missing Authentication for Critical Function

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthenticated attacker with network access to the appliance could read and modify a limited set of setup records, including a contact name and email address captured...

PT-2026-103592

Name of the Vulnerable Software and Affected Versions Apeos C4571 versions prior to 1.1.4 Apeos C3567 version 1.1.3 FUJIFILM and Sharp multifunction printers affected versions not specified Description A path traversal issue exists in the web management interface of several multifunction devices...

PT-2026-103557

Name of the Vulnerable Software and Affected Versions Kiteworks appliance affected versions not specified Description A setup interface in the appliance fails to enforce authentication after the initial configuration process is complete. This allows an unauthenticated attacker with network access...

PT-2026-103556

Name of the Vulnerable Software and Affected Versions Kiteworks appliance affected versions not specified Description A setup interface fails to properly confine user-supplied file paths to the intended directory. This allows an unauthenticated attacker with network access to the interface to wri...

CVE-2026-102123: Improper Limitation of a Pathname to a Restricted Directory

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthenticated attacker to write a file to any location writable by the affected service account, potentially compromising the integrity of the appliance or rendering i...

KLA91310 Multiple vulnerabilities in Mozilla Thunderbird ESR

Multiple vulnerabilities were found in Mozilla Thunderbird ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A...

KLA91311 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A...

PT-2026-103569

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description In multi-node deployments, an attacker with existing code execution on one appliance node can submit a value via an internal cluster interface. This value is...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2026:1778234216)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778234216 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a network-adjacent...

CVE-2026-103470: Incorrect Privilege Assignment

In Internet2 Grouper before 7.5.1 in some configurations, a user who is allowed to create or edit rules in the User Interface can escalate privileges...

PT-2026-103351

In Internet2 Grouper before 7.5.1 in some configurations, a user who is allowed to create or edit rules in the User Interface can escalate privileges...

The vulnerability of the command-line interface (CLI) of TP-Link Archer NX200, NX210, NX500, and NX600 Wi-Fi routers allows attackers to bypass existing security restrictions and execute arbitrary commands.

The vulnerability of the command-line interface CLI of TP-Link Wi-Fi router microprogramming systems such as Archer NX200, NX210, NX500, and NX600 is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remo...

The vulnerability in the Web module of the Open Interface Service of the Siemens Siveillance Control software for video surveillance and security systems allows a intruder to escalate their privileges and gain full control over the system to execute arbitrary codes.

The vulnerability of the Open Interface Service in the web module of the Siemens Siveillance Control video surveillance and security management software is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to enhance their privileges and...

CVE-2026-94952

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT NTR150 firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw port-forwarding configuration handler and is triggered by the ipsubnet and fwip request parameters during th...

CVE-2026-94953

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT NTR150 firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formAjaxSet using the topicurl=setting/setWiFiRepeaterConfig branch and the ApCliWEPKey field...

CVE-2026-76737

An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of...

CVE-2026-100292

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...