CVE-2024-27123: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later...

CVE-2026-57228: Out-of-bounds Read

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

CVE-2026-16777: Improper Limitation of a Pathname to a Restricted Directory

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-88623: Files or Directories Accessible to External Parties

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

CVE-2026-73863: Out-of-bounds Read

NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmqsubinfodecode function in nng/src/sp/protocol/mqtt/mqttparser.c reuses lenofvarint from the outer Properties Length while parsing each SUBSCRIPTIONIDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte...

CVE-2026-86689: Cleartext Transmission of Sensitive Information

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker...

CVE-2026-93593: Incorrect Authorization

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

CVE-2026-65969: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A truncated tga can leave a pending gif frame that is processed during output close. gifsplitpalette computes numpixels...

CVE-2026-14323: Improper Limitation of a Pathname to a Restricted Directory

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server...

PT-2026-95353

Name of the Vulnerable Software and Affected Versions NetBackup Flex OS affected versions not specified Description An authenticated user with access to the management shell can read arbitrary files from the underlying operating system. This is achieved by providing a specially crafted path...

PT-2026-95227

Name of the Vulnerable Software and Affected Versions OAKlouds affected versions not specified Description An Arbitrary File Read issue exists in OAKlouds developed by HGiga. Unauthenticated remote attackers can use Relative Path Traversal—a technique used to access files and directories stored...

CVE-2026-84451: Out-of-bounds Read

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

CVE-2026-13684: Improper Encoding or Escaping of Output

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-13673: Incorrect Permission Assignment for Critical Resource

An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks...

CVE-2026-84451: Out-of-bounds Read

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, the no-icef full-item branch of uncdecoder::getcompressedimagedatauncompressed in libheif/codecs/uncompressed/uncdecoder.cc retains an addition-based range check that can wrap when a crafted uncompressed tile gr...

PT-2026-95310

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager DSM versions prior to 7.2.1-69057-12 Synology DiskStation Manager DSM versions prior to 7.2.2-72806-9 Synology DiskStation Manager DSM versions prior to 7.3.2-86009-4 Synology DiskStation Manager DSM versions prior...

PT-2026-95388

Name of the Vulnerable Software and Affected Versions NUUO Network Video Recorder version 2.0.0 Description An arbitrary file read issue exists in the 'up.php' endpoint. The application receives the url parameter via a POST request and uses the fopen function to open the specified URL in binary...

PT-2026-95409

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An out-of-bounds read exists in the gptp mi qualify announce function within subsys/net/l2/ethernet/gptp/gptp mi.c. The issue occurs when processing the Path Tra...

CVE-2026-16514: Out-of-bounds Read

gptpmiqualifyannounce in subsys/net/l2/ethernet/gptp/gptpmi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce-stepsremoved accepted up to 254...

CVE-2026-91142: Out-of-bounds Write

A flaw was found in Cockpit. An integer overflow vulnerability in the dolastlog function, specifically in the offset calculation for lastlog entries on ILP32 Integer, Long, Pointer 32-bit builds, can be exploited. A low-privileged authenticated user with a specially provisioned large User ID UID...