PT-2026-117459

FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and manage settings checks. A low-privileged staff account with...

PT-2026-117662

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...

PT-2026-118058

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

PT-2026-117630

Name of the Vulnerable Software and Affected Versions Grav API plugin grav-plugin-api versions 1.0.16 through 1.0.41 Description The plugin contains two distinct issues. First, the unauthenticated GET '/api/v1/translations/lang' endpoint caches a full translation dictionary for every well-formed...

PT-2026-118061

Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

PT-2026-117218

A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/mat pixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched...

PT-2026-117214

A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper...

CVE-2026-109437: Initialization of a Resource with an Insecure Default

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

CVE-2026-109434: User Interface (UI) Misrepresentation of Critical Information

Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attacker...

PT-2026-117440

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain...

PT-2026-117412

sglang-router sgl-model-gateway through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/ endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped...

PT-2026-118057

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

Wazuh API Brute Force Unauthorized Access

The vulnerability of the application programming interface of the security monitoring and threat detection platform Wazuh is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability allows a malicious actor to carry out an attack using brute-force methods and...

CVE-2026-112188: Exposure of Sensitive Information to an Unauthorized Actor

MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name to a node in the configuration tree. When a branch name such...

CVE-2026-112074: Integer Overflow or Wraparound

A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/matpixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched...

CVE-2026-112097: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactionshandler.php?action=savesale of the component Sales Management Handler. The manipulation of the argument HsnCode results in cross site scripting. It is possible...

CVE-2026-112096: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactionshandler.php?action=savepurchase of the component Purchase Records Handler. The manipulation of the argument ProductName/ProductCode/VendorName leads to cross...

CVE-2026-111915: Improper Limitation of a Pathname to a Restricted Directory

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlist...

CVE-2026-111862: Embedded Malicious Code

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a...

CVE-2026-111056: Exposure of Sensitive Information to an Unauthorized Actor

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted ema...