CVE-2026-100856

AzuraCast before 0.23.6 contains a code injection vulnerability in the remote relay password field due to incomplete migration from the vulnerable cleanUpString method to toRawString. Attackers with RemoteRelays station permission can inject nested Liquidsoap interpolation syntax to execute...

CVE-2026-100745

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the...

CVE-2026-100835

Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it, so attestation was not bound to...

CVE-2026-100744

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100740

A vulnerability was detected in D-Link DIR-895L A1102b07. Impacted is the function tunnelsetparams of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may b...

EUVD-2026-87817

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744 coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpdateResource.php of the component Route-Level Middleware. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The...

CVE-2026-100744

A flaw in coollabsio Coolify versions up to 4.1.2 within the Route-Level Middleware component leads to a missing authorization vulnerability. The issue resides in an unknown function within the app/Http/Middleware/CanUpdateResource.php file. This flaw can be triggered via a remote manipulation at...

CVE-2026-100740 D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write

A vulnerability was detected in D-Link DIR-895L A1102b07. Impacted is the function tunnelsetparams of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may b...

EUVD-2026-87816

A vulnerability was detected in D-Link DIR-895L A1102b07. Impacted is the function tunnelsetparams of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may b...

CVE-2026-100740

The D-Link DIR-895L router, running firmware A1_102b07 , contains an out-of-bounds write (CWE-787 / CWE-119) vulnerability in the L2TP Control Channel Parser within the tunnel.c file. Specifically, the tunnel_set_params() function fails to properly handle the Host Name AVP ; while the length is c...

CVE-2026-100740 D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write

A vulnerability was detected in D-Link DIR-895L A1102b07. Impacted is the function tunnelsetparams of the file tunnel.c of the component L2TP Control Channel Parser. Performing a manipulation results in out-of-bounds write. The attack may be initiated remotely. The exploit is now public and may b...

EUVD-2026-87814

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...

CVE-2026-100878: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulation of the argument userId/roleIds lea...

CVE-2026-100724: Inconsistent Interpretation of HTTP Requests

http4k Maven package org.http4k:http4k-core before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring Contains matching on the Host header by default in reverseProxy and reverseProxyRouting when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP...

PT-2026-99698

Name of the Vulnerable Software and Affected Versions FAST FAC1200R version 5.0 20201119 1.0.2 Description A stack-based buffer overflow occurs in the parse advertisement frame function of the devdiscover Service. This issue allows a remote attacker to manipulate the service, potentially leading ...

PT-2026-99557

Name of the Vulnerable Software and Affected Versions Heym versions prior to 0.0.53 Description Insufficient verification of the X-Telegram-Bot-Api-Secret-Token header occurs on Telegram webhook endpoints when the credential id is absent or the secret token is empty. This allows remote...

PT-2026-99726

Name of the Vulnerable Software and Affected Versions Krayin laravel-crm versions prior to 2.2.5 Description An authorization bypass exists in the admin-config-setup component within the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php. This issue allows a remote attacker to bypa...

CVE-2026-100884: Improper Control of Resource Identifiers

A vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file packages/Webkul/Admin/src/Config/acl.php of the component attachment-download Endpoint. The manipulation of the argument ID leads to improper control of resource...