PT-2026-60850

Name of the Vulnerable Software and Affected Versions django-pyas2 versions prior to 1.2.4 Description An OS command injection flaw exists where the cmd receive and cmd send fields on the Partner model are passed directly to the os.system function in pyas2/utils.py without proper sanitization. Th...

OPENSUSE-SU-2026:11304-1 system-user-zabbix-7.0.28-1.1 on GA media

These are all security issues fixed in the system-user-zabbix-7.0.28-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-60808

Name of the Vulnerable Software and Affected Versions GisLab Laboratory Management System versions 1.4.03 through 08072026 Description An unauthenticated SQL injection exists in the web application backend due to improper neutralization of special elements used in SQL commands. This occurs when...

CVE-2026-42168

The CVE covers django-pyas2 up to version 1.2.3, where the Partner model’s cmd_receive and cmd_send fields are passed directly to os.system() in pyas2/utils.py. The underlying vulnerability is OS command injection, exploitable when an AS2 message is received or sent, allowing an authenticated adm...

The vulnerability of the executable file Def.exe in the IGSS definition SCADA system allows a perpetrator to execute arbitrary code.

The vulnerability of the Def.exe executable of the IGSS Definition SCADA system involves buffer overflow attacks. Exploiting this vulnerability allows an attacker to execute arbitrary code...

RabbitMQ 4.1.x < 4.1.11 / 4.2.x < 4.2.6 UNC Path Injection (Windows)

The version of RabbitMQ installed on the remote Windows host is affected by a vulnerability: - On Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension...

CVE-2026-42168

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...

CVE-2026-42168

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...

CVE-2026-52203

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter...

PT-2026-60650

Name of the Vulnerable Software and Affected Versions Grav API plugin versions prior to 1.0.0-rc.16 Description The plugin accepts JWT JSON Web Token access tokens via the token URL query parameter on every API route through the JwtAuthenticator::extractBearerToken fallback. This behavior causes...

SAP NetWeaver AS ABAP Memory Corruption (3747367)

The version of SAP NetWeaver AS ABAP detected on the remote host is affected by a memory corruption vulnerability as referenced in SAP Security Note 3747367: - SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory...

CVE-2026-52203

CVE-2026-52203 concerns MCMS 6.1.1 where a remote attacker can obtain sensitive information via the source parameter. The available documents consistently identify MCMS v6.1.1 as affected and describe information disclosure as the outcome. CVSS metrics (from the initial entry) indicate a Network ...

PT-2026-60740

A vulnerability was detected in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /prescriptionorderdetail.php. The manipulation of the argument delid results in sql injection. The attack can be launched remotely. The exploit is now public and may be used...

CVE-2026-42168

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...

PT-2026-60867

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Authenticated users can escalate their privileges to superuser by directly manipulating the database. This allows for the execution of arbitrary system commands, potentially leading to...

The vulnerability of the Vim text editor lies in the lack of measures to neutralize special elements used in operating system commands, allowing attackers to execute arbitrary commands.

The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

The vulnerability of the Microsoft Message Queuing (MSMQ) queue service on Windows operating systems allows a perpetrator to execute arbitrary code.

The vulnerability of the Microsoft Message Queuing MSMQ service on Windows operating systems is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code remotely...

The vulnerability of the asn1DecodeSnmp() function in the printing server’s CUPS implementation allows a attacker to disclose protected information or cause service failures.

The vulnerability of the asn1DecodeSnmp function in the CUPS printing server is related to reading data beyond the allowed range of memory. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information or cause service failures...

The vulnerability of the PCL encoder in the console-based image editing tool ImageMagick allows a hacker to trigger a service failure.

The vulnerability of the PCL encoder in the console-based image editing tool ImageMagick is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-57075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec. The base64 decoder in the bundled...