PT-2026-102399

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description A command injection issue exists that allows remote attackers to execute arbitrary commands. The flaw is located in the /api/ZRQos/set online client endpoint, where improper handling of the ip...

PT-2026-99942

Name of the Vulnerable Software and Affected Versions WatchGuard AP affected versions not specified Description An OS command injection flaw exists in the internal API service. This issue allows an attacker with network access to the access point to execute arbitrary shell commands on the...

CVE-2026-75600: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-100903: Missing Authentication for Critical Function

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is...

PT-2026-99799

Name of the Vulnerable Software and Affected Versions Apache Roller version 6.1.5 Description An authentication bypass exists due to a capture-replay flaw in the AtomPub API. An attacker can capture a valid WSSE digest authentication header and replay it to gain the authority of the victim. This...

PT-2026-99776

Name of the Vulnerable Software and Affected Versions WP Verify API WordPress plugin version 1.0.0 Description An authorization check is missing in a REST route, which allows unauthenticated users to insert arbitrary data into the plugin database table. Additionally, this flaw enables the site to...

PT-2026-99869

Name of the Vulnerable Software and Affected Versions NooBaa affected versions not specified Description An OS command injection flaw exists in the set hostname internal function of the 'cluster internal api' component, which manages the Multi-Cloud Object Gateway in OpenShift Data Foundation. Th...

PT-2026-102288

Name of the Vulnerable Software and Affected Versions Bluehood versions prior to 0.7.1 Description When auth enabled is active, session validation is only enforced on HTML page handlers. The /api/ endpoints, including /api/device/mac/notes, do not perform authentication checks. A network attacker...

PT-2026-99861

Name of the Vulnerable Software and Affected Versions dbgate versions prior to 7.3.2 Description A path traversal issue exists in the Archive Link Creation component. A remote attacker can manipulate the linkedFolder argument within the createLink function located in the...

CVE-2026-100885

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...

CVE-2026-100885 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...

CVE-2026-100885 Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization

A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization bypass. The attack may be launched...

CVE-2026-101085

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint t...

CVE-2026-101086

Nezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with nezha:service:write scope to submit privileged task types through the service API. Attackers can deliver command execution or Agent configuration tasks to...

CVE-2026-101089

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

africa.absa:inception-api (>=1.0.0, <=1.2.0), africa.absa:inception-codes-api (>=1.0.0, <=1.2.0) +42357 more potentially affected by unknown CVE via jakarta.validation:jakarta.validation-api (>=2.0.1, <=3.1.1)

jakarta.validation:jakarta.validation-api MAVEN version =2.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.4 and more Source cves: unknown CVE Source advisory:...

CVE-2026-101089 Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101089

Versions of Nezha before 2.2.7 are susceptible to an information disclosure vulnerability within the GET /api/v1/profile endpoint. This flaw allows authenticated users to retrieve their bcrypt-hashed password field. Because there are no rate limiting or audit trail constraints, an attacker can ex...

CVE-2026-101089 Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...

CVE-2026-101089 Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints...