CVE-2026-100894: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects some unknown processing of the file updateguest.php. The manipulation of the argument gname leads to sql injection. The attack may be initiated remotely. Th...

CVE-2026-100888: Out-of-bounds Write

A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the function dkimcanonselecthdrs of the file libopendkim/dkim-canon.c of the component DKIM Signature Header Selection. Executing a manipulation of the argument h can lead to out-of-bounds write. The atta...

CVE-2026-101262: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/setonlineclient. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi...

CVE-2026-101204: Out-of-bounds Read

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure bu...

PT-2026-99882

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...

PT-2026-99905

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1 Description The Git webhook receiver the gitjob webhook service fails to verify incoming requests when a webhook secret is not configured. This allows a remote caller with network access to the...

PT-2026-102384

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure bu...

PT-2026-102400

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description Remote command injection is possible due to improper processing of the /api/ZRQos/set online client endpoint. An attacker can exploit this by manipulating the mac argument to execute arbitrary...

PT-2026-99883

Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102 Description An OS command injection flaw exists in the CGI Handler component. A remote attacker can exploit this by manipulating the ip argument within the /ap ip.cgi endpoint, which is processed by the system...

PT-2026-99881

A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers/runners.js of the component Files Endpoint. The manipulation of the argument runid leads to path traversal. The attack is possible to be...

CVE-2026-101011: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function getdomainstatus of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the...

PT-2026-102333

Name of the Vulnerable Software and Affected Versions Eleveo Quality Management version 9.7.0 Description A remote information disclosure issue exists within the functionality of the file /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload. An attacker can remotel...

PT-2026-99757

Name of the Vulnerable Software and Affected Versions athlon1600 youtube-downloader versions prior to 4.0.2 Description Remote attackers can perform server-side request forgery SSRF by manipulating the url argument within the stream function located in the public/stream.php file. Server-side...

CVE-2026-101202: Out-of-bounds Write

A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipulation can lead to out-of-bounds write. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure b...

PT-2026-99791

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description Incorrect authorization in the OAuth 1.0a authorization endpoint allows an unauthenticated remote attacker to bind an outstanding request token for a configured site-wide consumer to an arbitrary user...

Netty IpSubnetFilterRule Comparator Bypass

The vulnerability of the IpSubnetFilterRule.compareTo function in the framework for developing network applications, servers, and Netty protocol clients is related to improper checking of the specified data type for input data. Exploiting this vulnerability can allow an attacker to bypass securit...

CVE-2026-101071: Unrestricted Upload of File with Dangerous Type

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...

Atlassian Confluence 8.9.x < 9.2.24 / 9.3.x < 10.2.17 (CONFSERVER-104443)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104443 advisory. - In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java L...

DnsResolveContext Component Bypass Security Restrictions

The vulnerability of the DnsResolveContext component in the framework for developing network applications, servers, and Netty protocol clients is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow an attacker to bypass security restrictions remotely...

PHPseclib SSRF

The vulnerability of the PHPseclib cryptographic protocol interpreter library is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform a SSRF attack remotely...