CVE-2026-19360

CVE-2026-19360 affects wongcyrus ExcelLexBot (versions up to 0.0.3) via the ExcelLexBotS3TriggerFunction in the Lambda Function Handler. The root cause is improper privilege management, with a remote-compatible attack vector described in the entry. The vulnerability impacts products that are no l...

CVE-2026-19358

A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure...

EUVD-2026-54929

A weakness has been identified in 3CORESec Trapdoor up to 1.2.2. Affected by this vulnerability is the function DefaultFunction. This manipulation causes improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure...

CVE-2026-19357 MingSoft MCMS ms-mdiy get information disclosure

A security flaw has been discovered in MingSoft MCMS up to 3.0.6. Affected is an unknown function of the file /mdiy/form/get of the component ms-mdiy. The manipulation results in information disclosure. It is possible to launch the attack remotely. The exploit has been released to the public and...

CVE-2026-19356 MingSoft MCMS ms-mdiy list information disclosure

A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

EUVD-2026-54919

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

CVE-2026-19350

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...

CVE-2026-19350

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...

CVE-2026-19350 Dolibarr ERP TakePOS invoice.php fail authorization

A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is...

CVE-2026-19346

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may b...

CVE-2026-19346

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may b...

PT-2026-69283

Name of the Vulnerable Software and Affected Versions code-projects Task Management System version 1.0 Description An improper authentication issue exists within the Login component in the /index.php file. A remote attacker can bypass authentication by manipulating the Password argument...

Linux Distros Unpatched Vulnerability : CVE-2026-19113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Consul Community Edition and Consul Enterprise 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A...

CVE-2026-71955

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resultin...

CVE-2026-71950

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the actionvalue field, resulting in command execution...

CVE-2026-71954 D-Link DWR-M961 Command Injection via /boafrm/formL2tpv3ConfigSetup

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in...

CVE-2026-19263

A vulnerability was found in INQUIRELAB mcp-bridge-api up to b30a82aa1d1d1139e0de846c41c8aadee6e06114. The impacted element is an unknown function of the file mcp-bridge.js of the component Servers Endpoint. Performing a manipulation of the argument command/args results in command injection. It i...

PT-2026-69215

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 hardware version C1 versions prior to 1.1.5 C1 202607071108 Description A command injection issue exists in the '/boafrm/formUSSDSetup' endpoint. A remote attacker can inject arbitrary malicious commands through the ussdValue a...

PT-2026-69231

Name of the Vulnerable Software and Affected Versions MSI Radix AXE6600 version v781521 Description A command injection issue exists in the 'wps.cgi' endpoint. Remote attackers can execute arbitrary commands and obtain root privileges by providing malicious input through the pin2g, pin5g, or pin6...

PT-2026-69187

Name of the Vulnerable Software and Affected Versions INQUIRELAB mcp-bridge-api versions up to b30a82aa1d1d1139e0de846c41c8aadee6e06114 Description A command injection issue exists in the Servers Endpoint component within the mcp-bridge.js file. A remote attacker can exploit this by manipulating...