EUVD-2026-25962

A vulnerability was identified in duartium papers-mcp-server 9ceb3812a6458ba7922ca24a7406f8807bc55598. Impacted is the function searchpapers of the file src/main.py. Such manipulation of the argument topic leads to path traversal. The attack may be launched remotely. The exploit is publicly...

PT-2026-35665

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function get cart count of the file /admin/ajax.php?action=get cart count. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit ha...

CVE-2026-7247: Buffer Copy without Checking Size of Input

A vulnerability has been found in D-Link DI-8100 16.07.26A1. Affected by this issue is the function fileextenasp of the file fileexten.asp of the component File Extension Handler. The manipulation of the argument Name leads to buffer overflow. Remote exploitation of the attack is possible. The...

PT-2026-35683

A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PHP/AdminUpdateAlbum.php. This manipulation of the argument txtimage causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been published and...

PT-2026-35652

A vulnerability has been found in jackwrichards FastlyMCP up to 6f3d0b0e654fc51076badc7fa16c03c461f95620. This impacts an unknown function of the file fastly-mcp.mjs of the component fastly cli Tool. The manipulation of the argument command leads to os command injection. It is possible to initiat...

PT-2026-35664

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function Login of the file /admin/ajax.php?action=login. The manipulation of the argument e-mail results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

TOTOLINK A8000RU operating system command injection vulnerability (CNVD-2026-32576)

TOTOLINK A8000RU is a wireless router produced by China Jiying Electronics. The TOTOLINK A8000RU has a vulnerability related to operating system command injection. This vulnerability stems from the CsteSystem function in the file/cgi-bin/cstecgi.cgi, which fails to properly handle HTTP parameters...

PT-2026-35824

Name of the Vulnerable Software and Affected Versions Xuxueli xxl-job versions prior to 3.4.0 Description A security flaw exists in the Execution Log Handler component within the logDetailCat function of the JobLogController.java file. Remote manipulation of the logId argument leads to improper...

PT-2026-35828

Name of the Vulnerable Software and Affected Versions eiceblue spire-pdf-mcp-server version 0.1.1 Description A flaw in the PDF File Handler component allows for remote path traversal. This occurs when the filepath argument is manipulated within the get pdf path function located in the src/spire...

PT-2026-35718

A vulnerability was detected in DV0x creative-ad-agent up to 751b9e5146604dc65049bd0f62dcbdad6212f8a3. Impacted is an unknown function of the file server/sdk-server.ts of the component creative-ad-agent-server. Performing a manipulation of the argument req.params results in path traversal. Remote...

PT-2026-35709

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of the file pizza/index.php?page=category. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploi...

PT-2026-45096

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-432BRP version 3.10B20 Description A stack-based buffer overflow occurs due to the manipulation of the filter name argument within the formSetMACFilter function located in the /goform/formSetMACFilter file. This allows for remote...

PT-2026-35672

A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith of the file scripts/component server/server.js. Executing a manipulation of the argument request.url can lead to path traversal. The attack can be launched remotely. The exploi...

PT-2026-35575

Name of the Vulnerable Software and Affected Versions dubydu sqlite-mcp versions prior to 0.1.1 Description A flaw in the extract to json function within the src/entry.py file allows for remote SQL injection. This occurs when the output filename argument is manipulated, enabling an attacker to...

Google Chrome 安全漏洞

Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 147.0.7727.138 contained a security vulnerability caused by a heap buffer overflow in the WebRTC component. This vulnerability could allow remote attackers to exploit the heap corruption through specially...

CVE-2026-7226: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects the function login2 of the file /admin/ajax.php?action=login2. The manipulation of the argument e-mail leads to sql injection. Remote exploitation of the attack is possible. The exploit h...

CVE-2026-7288: Buffer Copy without Checking Size of Input

A vulnerability has been found in D-Link DIR-825M 1.1.12. This vulnerability affects the function sub4151FC of the file /boafrm/formVpnConfigSetup. The manipulation of the argument submit-url leads to buffer overflow. Remote exploitation of the attack is possible. The exploit has been disclosed t...

CVE-2026-7265: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of the file pizza/index.php?page=category. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploi...

FastlyMCP 命令注入漏洞

FastlyMCP is an AI assistant tool developed by Jack Richards for managing CDN services via APIs. FastlyMCP has a command injection vulnerability, which stems from the fastly-mcp.mjs file within the fastlycli tool component. This vulnerability involves command parameters that allow for OS command...

CVE-2026-7271: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in DV0x creative-ad-agent up to 751b9e5146604dc65049bd0f62dcbdad6212f8a3. Impacted is an unknown function of the file server/sdk-server.ts of the component creative-ad-agent-server. Performing a manipulation of the argument req.params results in path traversal. Remote...