PT-2026-125383

A vulnerability was determined in TOTOLINK A950RG 4.1.2cu.5268 B20221104. Affected is the function apmib set of the file firewall.so. This manipulation causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized...

UBUNTU-CVE-2026-115349

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...

PT-2026-123274

A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function image of the file application/mp/controller/Show.php of the component Mp Module Media Proxy. The manipulation of the argument url results in server-side...

PT-2026-123410

A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgradin...

PT-2026-125106

A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is an unknown function of the file patientregistration.php. Such manipulation of the argument pat name leads to cross site scripting. The attack can be launched...

PT-2026-125382

A vulnerability was found in TOTOLINK A950RG 4.1.2cu.5268 B20221104. This impacts the function getDeviceInfo of the file /var/lib/misc/udhcpd.leases of the component device-information Handler. The manipulation of the argument MAC address results in command injection. The attack can be launched...

PT-2026-123197

A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been made available t...

PT-2026-125482

Name of the Vulnerable Software and Affected Versions flatcc versions prior to 0.6.5 Description An out-of-bounds read occurs in the flatcc json parser number function when processing numbers that end with a decimal point. An attacker can provide untrusted JSON data that terminates immediately...

PT-2026-123331

A vulnerability was determined in Kameleo up to 5.0.1.26. Affected is the function InternalController.TestProxy of the file client-engine-application/f.cs of the component Proxy Validation. Executing a manipulation of the argument host/port can lead to server-side request forgery. The attack may ...

PT-2026-123332

A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local...

CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes plyreadlistproperty call an out-of-bounds handler, crashing ASCII parsing or...

PT-2026-125462

A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268 B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly...

PT-2026-125535

A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may ...

PT-2026-123192

A vulnerability has been found in fr0tt benotes up to 2.8.1. This affects the function getUrlInfo of the file app/Http/Controllers/PostController.php of the component Bookmark Metadata Endpoint. The manipulation of the argument url leads to server-side request forgery. The attack may be initiated...

PT-2026-123179

A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used...

PT-2026-123350

A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function of the file core/memory/database/api/v1/exec ddl.py of the component DDL Whitelist Handler. This manipulation causes incomplete blacklist. The attack may be initiated remotely. The exploit has bee...

PT-2026-123333

A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be...

PT-2026-125536

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has be...

CVE-2026-115349

Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity denial of service vulnerability in the parselinktext function in src/mistune/helpers.py. Attackers can submit markdown with deeply nested square brackets triggering quadratic parsing time, exhausting server CPU with small crafted...

PT-2026-123205

A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit is now public and...