Tenda G103 Component Arbitrary Command Execution

The vulnerability of the actionsetnetsettings function gpon.lua in the Setting Handler component of the GPON-terminal software Tenda G103 is related to the lack of measures to sanitize input data during the processing of parameters...

CVE-2026-92970

HUBzero CMS versions through 2.2.32 are affected by a path traversal vulnerability in project file upload handlers. Authenticated project members can supply traversal sequences in upload parameters to write arbitrary files to attacker-chosen paths outside the project repository, executing with we...

BIT-MONGODB-2026-82075 Uncontrolled Resource Consumption in MongoDB Sharded Cluster Router Allows Unauthenticated Denial of Service

An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client that has network access to a router port and has not authenticated can supply connection-monitoring parameters that cause the server to expend CPU resources...

CVE-2026-92893

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

CVE-2026-92893 Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

CVE-2026-92893 Rubygem-foreman_ansible: ansible inventory api ignores view_hosts permission filters, exposes hidden parameters

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

CVE-2026-92893

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

EUVD-2026-81355

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into...

CVE-2026-92893: Incorrect Authorization

A flaw was found in the foremanansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where call that does not enforce the search filter associated with the caller's viewhosts permission. An authenticated user whose host visibility is restricted by a...

PT-2026-94174

Name of the Vulnerable Software and Affected Versions Autopay WordPress plugin versions prior to 5.0.1 Description An issue exists where the plugin fails to enforce the signature on a payment callback. This allows unauthenticated users to disclose and delete stored payment parameters associated...

CVE-2026-92581

In AVideo through 29.0, Like::construct performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like...

CVE-2026-92581 AVideo through 29.0 Like Counter Desynchronization via Array Parameter

In AVideo through 29.0, Like::construct performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like...

CVE-2026-76646

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, ...

EUVD-2026-80956

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, ...

keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

CVE-2026-85104 Brain stimulation parameters can be modified via Bluetooth in Sooma

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters...

EUVD-2026-80739

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters...

CVE-2026-73176

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-73165

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...