PT-2026-22402

Name of the Vulnerable Software and Affected Versions Canarytokens versions prior to sha-7ff0e12 Description The Canarytokens PWA Canarytoken has a Self Cross-Site Scripting issue. A Canarytoken creator can execute Javascript code by inserting it into the title field of their PWA token. This allo...

Vivo Health 安全漏洞

Vivo Health is a sports guidance and health management software developed by the Chinese company Vivo. There is a security vulnerability in Vivo Health, which stems from insufficient protection mechanisms, potentially leading to the leakage of certain information...

PT-2026-22296

A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/main/java/com/youlai/mall/pms/controller/app/SpuController.java of the component App-side Product Pagination Endpoint. Performing a manipulation of t...

youlai-mall SQL注入漏洞

Youlai-Mall is a full-stack e-commerce system developed by Youlaitech. Version 2.0.0 of Youlai-Mall has a SQL injection vulnerability. This vulnerability stems from incorrect handling of the parameter sortField/sort in the function listPagedSpuForApp located in the...

Vikunja 授权问题漏洞

Vikunja is an open-source to-do application developed by Vikunja developers. Versions of Vikunja prior to 2.1.0 had a security vulnerability related to authorization. This vulnerability stemmed from the possibility of password reset tokens being reused indefinitely, which could lead to account...

CVE-2026-3287: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in youlaitech youlai-mall 2.0.0. This affects the function listPagedSpuForApp of the file mall-pms/pms-boot/src/main/java/com/youlai/mall/pms/controller/app/SpuController.java of the component App-side Product Pagination Endpoint. Performing a manipulation of t...

CVE-2026-27149

creationtimestamp| type| source ---|---|--- 2026-02-26 22:43:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsbgdaiho2e...

CVE-2026-28193

In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint...

CVE-2026-27510

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application com.unitree.doggo2, are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLi...

CVE-2026-27510

creationtimestamp| type| source ---|---|--- 2026-02-26 19:28:11+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mfrwjim45725 2026-02-26 20:39:33+00:00| seen| https://bsky.app/profile/r-netsec.bsky.social/post/3mfs2j4uxcn2u 2026-02-27 08:52:53+00:00| seen|...

CVE-2026-27510 Unitree Go2 Mobile Program Tampering Enables Root RCE

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application com.unitree.doggo2, are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLi...

CVE-2026-27510

Unitree Go2 firmware versions 1.1.7 through 1.1.11, when used with the Unitree Go2 Android application com.unitree.doggo2, are vulnerable to remote code execution due to missing integrity protection and validation of user-created programmes. The Android application stores programs in a local SQLi...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to IBM Java SDK (CVE-2026-21945,CVE-2026-21932,CVE-2026-21933 & CVE-2026-21925))

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple vulnerabilities due to IBM Java SDK. Vulnerability Details CVEID:CVE-2026-21945 DESCRIPTION: Java SE is vulnerable to a denial of service, caused by an easily exploitable vulnerability issue that allows...

CVE-2026-26228 VLC for Android < 3.7.0 Remote Access Path Traversal

VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download. The file query parameter is concatenated into a filesystem path under the configured download directory without canonicalizatio...

CVE-2026-26228

VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server routing for the authenticated endpoint GET /download. The file query parameter is concatenated into a filesystem path under the configured download directory without canonicalizatio...

CVE-2026-2680

Reflected Cross-Site Scripting XSS on the A3factura web platform, in parameter 'customerVATNumber', in 'a3factura-app.wolterskluwer.es//incomes/salesDeliveryNotes' endpoint, which could allow an attacker to execute arbitrary code in the victim's browser...

CVE-2026-1692

creationtimestamp| type| source ---|---|--- 2026-02-26 09:16:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfquctx5nm2z...

CVE-2026-1697

CVE-2026-1697 affects PcVue components: GraphicalData web services and the WebClient web app, across versions 12.0.0 through 16.3.3. The underlying issue is the use of unsecure cookies due to missing Secure and SameSite attributes, enabling potential cookie exposure. Metrics show a Network-attack...

CVE-2026-1697

The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included...

CVE-2026-27595

Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint POST /apps/:appId/agent has multiple security vulnerabilities that, when chained, allow unauthenticated remote attackers to perform arbitrary read...