IServ Schoolserver User Enumeration

IServ Schoolserver suffers from a user enumeration vulnerability. The vendor does not feel this is an issue...

PT-2026-89386

Name of the Vulnerable Software and Affected Versions AVideo versions prior to c3edcc274c389816d434acadac07ee78eaf330c1 Description Incomplete sanitization of sensitive user fields occurs in the APIName=video response. The API::get api video function calls removeSensitiveUserFields only when the...

CVE-2026-88026: Improper Neutralization of Special Elements in Data Query Logic

Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a...

PT-2026-89631

🚨 CVE-2026-81268 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation. 🎖@cveNotify...

(Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must open a malicious folder. The specific flaw exists within the handling of configuration files. The issu...

VulnCheck KEV: CVE-2026-42018

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources...

CVE-2026-0305: Exposure of Sensitive Information to an Unauthorized Actor

An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and credentials. The Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected...

PT-2026-89338

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user meta save function which only sanitizes array values, not scalar...

PT-2026-89311

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated...

PT-2026-89594

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...

PT-2026-89658

An information disclosure vulnerability in the SAML Single Sign-On SSO functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could...

PT-2026-89758

Name of the Vulnerable Software and Affected Versions The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress versions prior to 2.10.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping...

CVE-2026-18994: Improper Export of Android Application Components

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...

CVE-2026-19136: Improper Neutralization of Special Elements used in an OS Command

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application...

CVE-2026-63427: Authentication Bypass by Spoofing

An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges...

CVE-2026-0306: Protection Mechanism Failure

A vulnerability in the EndPoint Data Loss Prevention DLP enforcement of Palo Alto Networks Prisma® Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data. This Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not...

CVE-2026-0302: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov...

PT-2026-89541

Name of the Vulnerable Software and Affected Versions MongoDB integration for Laravel affected versions not specified Description Improper neutralization of special elements in data query logic within the embedded-document relation handling allows an authenticated user to manipulate an embedded...

PT-2026-89281

An information disclosure vulnerability in the Palo Alto Networks Prisma® Access Agent on Linux enables a local user to access sensitive configuration data and credentials. The Prisma Access Agent on macOS, Windows, iOS, Android and Chrome OS is not affected...

(Pwn2Own) OpenAI Codex External Control of System or Configuration Setting Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenAI Codex. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...