PT-2026-85541

Douyin TikTok Download API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services includi...

CVE-2026-75170

This stored XSS affects the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1 ). A remote unauthenticated attacker can inject arbitrary JavaScript by manipulating the language POST parameter , causing the application's response to execute attacker-controlled script in the ...

CVE-2026-75429

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

jdbhttpd 0.1.0 Path Traversal / File Disclosure

jdbhttpd version 0.1.0 suffers from path traversal and file disclosure vulnerabilities. https://packetstorm.news/download/230538...

EUVD-2026-71453

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer...

Linux Distros Unpatched Vulnerability : CVE-2026-71196

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - glance - None Ubuntu Linux - Unknown description CVE-2026-71196 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2026-80799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers nfcllcpparsegbtlv and nfcllcpparseconnectiontlv contain three related bugs in their TLV parsing loops:...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: cups-filters (UTSA-2026-106457)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106457 advisory. A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recovery handler, causing the...

Linux Distros Unpatched Vulnerability : CVE-2026-84968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read in the BSON decoding component of the MongoDB PHP driver may allow an unauthenticated party who supplies specially formed input to have a...

CVE-2026-79390

Trueview TI8161 (version 6.0.23.4) is vulnerable to information disclosure caused by the transmission of MQTT communications in plaintext over TCP port 1883 . An unauthenticated attacker with access to the same network segment can intercept this traffic and obtain sensitive device information and...

PT-2026-85630

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: bound SGL data length before allocating command buffers nvmet tcp map data reads the host-controlled 32-bit sgl-length and, for the in-capsule offset descriptor type 0x01, checks it against port-inline data size before...

EUVD-2026-71456

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an unauthenticated attacker t...

CVE-2026-79419

A reflected XSS vulnerability in EMX Tecnologia Gestao X Business Suite 8.4 and earlier is caused by insufficient validation and sanitization of the mensagem parameter at the /Configuracao/Imagens.aspx endpoint, allowing an attacker to inject arbitrary JavaScript executed in a victim's browser. T...

PT-2026-85691

IBM Operational Decision Manager 9.6.0.0, 9.5.0.0, 8.11.1.0, 8.11.0.1, 8.12.0.1, 9.5.0.1, and 9.0.0.1 is vulnerable to SQL injection. An unauthenticated attacker can execute arbitrary SQL statements and leverage database functionality to write a web shell to the application web root, resulting in...

PT-2026-85699

CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: https://t.co/2JPeD1RjLr CVE infosec XSS valtersit snippet infosec SysAdmin cybersecurity...

OpenCode Unauthenticated Remote Code Execution

OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability that can allow a remote attacker to obtain a session identifier and execute arbitrary commands through the session shell endpoint. This proof of concept retrieves an available session and demonstrate...

PT-2026-85464

Name of the Vulnerable Software and Affected Versions AI Website Builder WordPress plugin GitHub build version 1.0.0 Description Lack of authorization and nonce checks on REST API routes allows unauthenticated attackers to perform several unauthorized actions. These include installing and...

CVE-2026-79390

Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational...

EUVD-2021-34874

Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight...

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...