EUVD-2026-77140

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter of the file /boafrm/formFilter of the component boa. Executing a manipulation of the argument ip6addr can lead to buffer overflow. The attack can be executed remotely. The...

EUVD-2026-77139

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

EUVD-2026-77129

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/invedit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may b...

CVE-2026-90604

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

CVE-2026-90814: Server-Side Request Forgery (SSRF)

A flaw has been found in cosmicstack-labs mercury-agent up to 1.1.13. Affected by this vulnerability is the function githubRequest of the file src/utils/github.ts of the component GitHub API Handler. This manipulation of the argument path causes server-side request forgery. Remote exploitation of...

PT-2026-91024

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read model of the file fedml/core/distributed/communication/s3/remote storage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3 key str causes...

PT-2026-91173

A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xaiOAuthCallback.ts of the component xAI OAuth Callback Handler. The manipulation of the argument Error leads to denial of service. Remote exploitation of the...

The vulnerability of SAP Business One’s resource management system, which exists due to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of SAP Business One’s resource management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the Service Manager component in the Oracle GoldenGate data flow management tool allows a hacker to gain full control over the application.

The vulnerability of the Service Manager component in the Oracle GoldenGate data flow management tool is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using the HTTP network protoc...

PT-2026-91249

Name of the Vulnerable Software and Affected Versions a2aproject a2a-python versions prior to 1.1.4 Description A server-side request forgery issue exists in the Push Notification Sender component. The problem occurs within the dispatch notification function located in the src/a2a/server/tasks/ba...

CVE-2026-90614: Deserialization of Untrusted Data

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.readmodel of the file fedml/core/distributed/communication/s3/remotestorage.py of the component MQTT+S3 Communication Backend. This manipulation of the argument s3keystr causes...

PT-2026-91444

Name of the Vulnerable Software and Affected Versions cosmicstack-labs mercury-agent versions prior to 1.1.14 Description A flaw in the GitHub API Handler component allows remote exploitation via server-side request forgery SSRF, a technique where an attacker induces the server to make requests t...

CVE-2026-90604: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

The vulnerability of the Adobe Experience Manager content and media management system, related to deficiencies in authentication procedures, allows a perpetrator to execute arbitrary code.

The vulnerability of the Adobe Experience Manager content and media management system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

PT-2026-91136

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made publi...

The vulnerability in the API for handling email addresses of Git repository managers like Gitea allows attackers to increase their privileges.

The vulnerability in the API for handling email addresses of Git repositories managed by Gitea is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms lies in the absence of authentication procedures, which allows attackers to compromise the integrity and accessibility of protected information.

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to compromise the integrity and accessibility of protected information from a remote location...

CVE-2026-90704: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made publi...

CVE-2026-90790: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3. This affects the function dispatchnotification of the file src/a2a/server/tasks/basepushnotificationsender.py of the component Push Notification Sender. The manipulation of the argument pushinfo.url leads to...

PT-2026-91250

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf node unregister of the file scenegraph/base scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be...