PT-2026-33659

A vulnerability was detected in ComfyUI up to 0.13.0. This impacts the function get model preview of the file app/model manager.py of the component Model Preview Endpoint. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. T...

PT-2026-33749

A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5. Affected by this issue is some unknown functionality of the component Asset Handler/Aggregate Handler. The manipulation results in improper neutralization of special elements in data query logic. It is possible to launch the attack...

The vulnerability of the graphical user interface of the software solution for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR allows a hacker to obtain the user’s password.

The vulnerability of the graphical user interface of the software solution for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR is related to the transmission of critical information in open text. Exploiting this vulnerability...

PT-2026-33707

A vulnerability has been found in Lagom WHMCS Template up to 2.4.2. This impacts an unknown function of the component Datatables. The manipulation leads to resource consumption. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor...

PT-2026-33736

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument proto causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The...

CVE-2026-6652: Improper Neutralization of Directives in Dynamically Evaluated Code

A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/modules/view/src/PhpEngine.php of the component StringStorage Template Handler. This manipulation causes improper neutralization of directives in dynamically evaluated code. Remote...

CVE-2026-6591: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in ComfyUI up to 0.13.0. Affected is the function folderpaths.getannotatedfilepath of the file folderpaths.py of the component LoadImage Node. This manipulation of the argument Name causes path traversal. Remote exploitation of the attack is possible. The exploit has been...

The vulnerability of the Mattermost instant messaging application, related to the lack of authentication, allows a malicious user to gain unauthorized access and modify protected information.

The vulnerability of the Mattermost instant messaging application is related to the lack of authentication. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access and modify protected information...

CVE-2026-6632: Buffer Copy without Checking Size of Input

A vulnerability was identified in Tenda F451 1.0.0.7cnsvn7958. The affected element is the function fromSafeClientFilter of the file /goform/SafeClientFilter of the component httpd. The manipulation of the argument menufacturer/Go leads to buffer overflow. Remote exploitation of the attack is...

PT-2026-33729

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14. This affects the function extract with bs4/extract with 3k/extract with lxml of the file superagi/helper/webpage extractor.py of the component WebScraperTool. Such manipulation leads to server-side request...

PT-2026-33715

A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form valid of the file oauth/views.py. This manipulation of the argument oauthid causes improper authorization. The attack may be initiated remotely. The exploit has been published and may be used...

PT-2026-33660

A flaw has been found in ComfyUI up to 0.13.0. Affected is the function folder paths.get annotated filepath of the file folder paths.py of the component LoadImage Node. This manipulation of the argument Name causes path traversal. Remote exploitation of the attack is possible. The exploit has bee...

The vulnerability of the Multimodal Message Handler component in the Spring AI development framework allows a attacker to perform an SSRF attack.

The vulnerability of the Multimodal Message Handler component in the Spring AI development framework relates to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

The vulnerability of the Pillow image processing library, related to unlimited resource distribution, allows a hacker to cause a service failure.

The vulnerability of the Pillow image processing library is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of Adobe Connect web conference software lies in the lack of measures taken to protect the structure of web pages, allowing attackers to carry out XSS attacks.

The vulnerability of Adobe Connect web conference software relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2026-6582

A flaw has been found in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function getvectordbdetails of the file superagi/controllers/vectordbs.py of the component Vector Database Management Endpoint. Executing a manipulation can lead to missing authentication. The attack...

CVE-2026-6584 TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization

A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function updateuser of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument userid results in authorization bypass. The attack may be...

CVE-2026-6582

TransformerOptimus SuperAGI up to 0.0.14: the get_vector_db_details function in superagi/controllers/vector_dbs.py of the Vector Database Management Endpoint is vulnerable to a manipulation that leads to missing authentication. This is a remote-exploit, with a publicly published exploit and confi...

CVE-2026-6581 H3C Magic B1 aspForm SetMobileAPInfoById buffer overflow

A vulnerability was detected in H3C Magic B1 up to 100R004. Affected by this vulnerability is the function SetMobileAPInfoById of the file /goform/aspForm. Performing a manipulation of the argument param results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now...

CVE-2026-6581

CVE-2026-6581 affects H3C Magic B1 devices up to firmware 100R004. The vulnerability lies in the function SetMobileAPInfoById in the file /goform/aspForm, where manipulation of the argument param causes a buffer overflow. Remote exploitation is possible and the exploit is public. Documents consis...