PT-2026-86205

Name of the Vulnerable Software and Affected Versions ILIAS versions prior to 9.22 ILIAS versions prior to 10.10 ILIAS versions prior to 11.3 Description A SQL injection issue exists in the repository trash table. The system fails to validate the table navigation sort field from HTTP requests...

CVE-2026-79419

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to...

PT-2026-85473

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been...

CVE-2022-35499: Improper Neutralization of Input During Web Page Generation

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL...

PT-2026-86255

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP IBCF-NATUP-01/NMSCI-WebGui/backup restore.jsp and NP IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will th...

CVE-2026-75164

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...

PT-2026-85598

Name of the Vulnerable Software and Affected Versions EMX Tecnologia Gestao X Business Suite versions prior to 8.5 Description A reflected cross-site scripting XSS issue occurs due to insufficient validation and sanitization of the mensagem parameter within the '/Configuracao/Imagens.aspx'...

PT-2026-85571

AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill path request parameter to copy files...

PT-2026-86267

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param set default file and param set backup file functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any P...

PT-2026-86246

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...

Linux Distros Unpatched Vulnerability : CVE-2026-76177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV...

Linux Distros Unpatched Vulnerability : CVE-2026-76175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator...

CVE-2026-85612: Server-Side Request Forgery (SSRF)

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...

PT-2026-86174

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...

EUVD-2026-71456

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an unauthenticated attacker t...

EUVD-2026-71450

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...

PT-2026-85557

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max neighbors, ef construction, and ef search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction...

PT-2026-85772

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralization of special elements...

CVE-2025-67066

A SQL Injection vulnerability exists in oasys sysoa version 1.0 . A remote attacker can exploit the outtype parameter within the /outaddresspaging path to execute arbitrary code. The vulnerability has a CRITICAL base severity score of 9.8, with high impact on confidentiality, integrity, and avail...

CVE-2022-26961

Italtel NetMatch-S 5.0.0-20200703 is vulnerable to Multiple Stored XSS due to improper neutralization of input during web page generation. The flaw exists in the backup_restore.jsp and storage.jsp components (under respective paths) via the name parameter . A malicious user can inject arbitrary J...