CVE-2026-18610

A vulnerability was detected in NewType WebEIP up to 3.0. This affects an unknown part of the file /EIPComFileList.aspx. The manipulation results in improper authentication. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early abo...

CVE-2026-18607 Wavlink NU516 lighttpd upload.cgi strcpy stack-based overflow

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. Affected by this issue is the function strcpy of the file upload.cgi of the component lighttpd. The manipulation o...

CVE-2026-33591

A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account...

EUVD-2026-52256

A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account...

CVE-2026-18593

A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotel...

CVE-2026-18593

A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotel...

CVE-2026-18593

Vulnerability CVE-2026-18593 affects vxcontrol PentAGI up to version 2.1.0. It targets an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl within the Tool Management Protocol Handler. The issue can be exploited remotely to cause sandbox-related problems; exploitation is descr...

EUVD-2026-52221

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

CVE-2026-18592

CVE-2026-18592 affects osCommerce version 4.14.63493, specifically the function EmailController in app/lib/backend/controllers/EmailController.php of the Email Template Configuration component. The issue arises from manipulating the email_templates_key argument, which leads to a SQL injection vul...

CVE-2026-21554

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed...

CVE-2026-21550

Technical details (affected product/component/version/exploitation) are not publicly available in the provided documents. Monitor for updates.

CVE-2026-18589

The CVE-2026-18589 entry concerns Wavlink WL-NU516U1 (model 708c073-mt7628). The vulnerability is in nas.cgi, affecting the change_password function where manipulating User1Passwd triggers a stack-based buffer overflow. It is a NETWORK-accessible flaw with LOW attack complexity and NO user intera...

CVE-2026-6694

A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics APNG image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow CWE-121, causing the file-png plugin to crash and resulting in a...

EUVD-2026-52160

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...

CVE-2026-18587 Wavlink WL-NU516U1 Config Import os command injection

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...

mysql: mariadb: InnoDB unspecified vulnerability (CPU Apr 2025)

A flaw was found in Oracle MySQL Server InnoDB component. A high-privileged remote attacker with network access can cause a denial of service DoS and gain unauthorized ability to modify data in MySQL Server...

GStreamer webrtcbin: inverted SDP fingerprint presence check enables remote SDP authentication-binding bypass

GStreamer webrtcbin: inverted SDP fingerprint presence check enables remote SDP authentication-binding bypass Vulnerability Overview While validating a remote SDP in the set-remote-description path, GStreamer webrtcbin's checksdpcrypto inverts the presence check for a=fingerprint attributes: an S...

CVE-2026-18582 mz-automation libiec61850 Report Sending Path reporting.c Reporting_RCBWriteAccessHandler free of memory not on the heap

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function ReportingRCBWriteAccessHandler of the file src/iec61850/server/mmsmapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not ...

CVE-2026-18582: Free of Memory not on the Heap

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function ReportingRCBWriteAccessHandler of the file src/iec61850/server/mmsmapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not ...

PT-2026-69889

Name of the Vulnerable Software and Affected Versions Metabase versions 0.58.0 through 0.63.4 Description An unauthenticated SQL injection exists in the password-reset flow. A remote attacker can send a crafted HTTP request to the POST /api/session/reset password endpoint containing an undeclared...