PT-2026-133527

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm resource takes no session token from the caller. It reads the redirect flow back from the...

PT-2026-133515

FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint POST /api/guest/staff/login that allows remote attackers to force authentication because checkGuestClientAuthentication only allowlists client login and client create, leaving staff logi...

PT-2026-133565

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-119037: Improper Verification of Cryptographic Signature

Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signaturevalid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty key. A secret read...

CVE-2026-119036: Allocation of Resources Without Limits or Throttling

Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is flattened into one key and...

CVE-2025-31704: Dahua Intelligent Connection Center: A vulnerability has been found in the Dahua Intelligent Connection Center

A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution...

MozJS MongoDB Unauthorized Access

The vulnerability in the MozJS component of MongoDB’s database management system is related to flaws in its authorization process. Exploitation of this vulnerability could enable a remote attacker to gain unauthorized access to protected information...

PT-2026-133637

xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer. handle auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an allowlisted MAC-address-shaped device...

VulnCheck KEV: CVE-2026-58115

A vulnerability has been identified in SIMATIC IoT2050 Advanced 6ES7647-0BA00-1YA2 All versions V4.3.4.1 running Industrial OS with Node-RED installed. Affected devices do not enforce authentication on the Node-RED HTTP interface, allowing unauthenticated access to programming nodes that are...

CVE-2026-119620: 37954679 cak-filemanagement-system: A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297

A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function moveuploadedfile of the file admin/addlogs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack ma...

CVE-2026-119619: 37954679 cak-filemanagement-system: A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297

A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqliquery of the file admin/savestudent.php. Performing a manipulation of the argument date/department/subject/forwardedto/actiontakenby/section/password...

PT-2026-133778

Name of the Vulnerable Software and Affected Versions FunnelKit Automations versions prior to 3.8.6.2 Description An unauthenticated attacker can send crafted serialized data to the application, leading to PHP Object Injection. This issue may allow for remote code execution or data tampering...

PT-2026-134226

ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing foll...

PT-2026-133735

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 7.1.4 WordPress versions prior to 7.0.8 WordPress versions prior to 6.9.11 WordPress versions prior to 4.7.39 Description A remote code execution issue exists during the core upgrade process. When a full upgrade...

PT-2026-133708

A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function mysqli query of the file admin/save student.php. Performing a manipulation of the argument date/department/subject/forwarded to/action taken by/section/passwor...

PT-2026-133728

A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move uploaded file of the file admin/add logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack...

PT-2026-134132

praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in internal/telegram/bot.go concatenate the attacker-controlled document filename into a destination path without sanitization,...

Linux Distros Unpatched Vulnerability : CVE-2026-119269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page...

CVE-2026-76026: Google Chrome: Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary…

Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-76029: Google Chrome: Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute…

Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...