EUVD-2026-84252

A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...

CVE-2026-94490 OctoPrint Command API system.py executeSystemCommand os command injection

A security flaw has been discovered in OctoPrint 1.0.0. Affected by this issue is the function executeSystemCommand of the file src/octoprint/server/api/system.py of the component Command API. Performing a manipulation of the argument command results in os command injection. It is possible to...

PT-2026-96727

Name of the Vulnerable Software and Affected Versions php-file-manager-with-code-editor versions prior to 3.1 Description A flaw in the move uploaded file function within the filemanager.php file allows for unrestricted file upload. This issue can be exploited remotely by manipulating the files...

PT-2026-96719

Name of the Vulnerable Software and Affected Versions sfturing hosp order versions prior to 627f426331da8086ce8fff2017d65b1ddef384f8 Description A remote cross site scripting issue exists within the Public Search Handlers component, specifically in the HospitalController.java file. The flaw allow...

PT-2026-96328

Name of the Vulnerable Software and Affected Versions Yonyou U8cloud versions 5.x Description A SQL injection issue exists within the OpenAPI component. A remote attacker can exploit this by manipulating the operator argument in the '/u8cloud/openapi/so.saleorder.sendaudit' endpoint. SQL injectio...

PT-2026-97117

Name of the Vulnerable Software and Affected Versions itsourcecode Leave Management System version 1.0 Description A remote SQL injection exists in the /module/leavetype/index.php endpoint. The issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary SQL command...

CVE-2026-94492: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in Yonyou U8cloud 5.x. This vulnerability affects unknown code of the file /u8cloud/openapi/so.saleorder.sendaudit of the component OpenAPI. The manipulation of the argument operator leads to sql injection. The attack can be initiated remotely. The explo...

PT-2026-97107

Name of the Vulnerable Software and Affected Versions anirbandutta9 College-Notes-Gallery versions up to 8c1cf3d98f30982d069c88ca172612c001eb39f6 Description An unrestricted upload issue exists in the /dashboard/userprofile.php?section=admin1 endpoint. A remote attacker can exploit this by...

On the Construction of Trapdoor Claw-Free Functions with Certifiable Key

Trapdoor claw-free functions TCFs underpin much of classical-quantum cryptographic interaction, yet every TCF-based protocol states its guarantees relative to an honestly generated key. We give a family-agnostic abstraction of key certification for noisy TCF constructions, built on two notions: a...

PT-2026-97116

Name of the Vulnerable Software and Affected Versions theRealSain Pixtream versions up to 866afd4f0cea812b918780fb74b67dccf8c4d6a0 Description A security flaw exists in the processing of the '/post upload.php' endpoint. Manipulation of the media argument allows for unrestricted file upload, which...

CVE-2026-77247: External Control of File Name or Path

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: amanda (UTSA-2023-002123)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002123 advisory. AMANDA Advanced Maryland Automatic Network Disk Archiver before tag-community-3.5.4 mishandles argument checking for runtar.c, a different vulnerability than...

CVE-2026-94426

A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-94426

xuxueli xxl-job up to version 3.5.0 is affected by a cross-site scripting (XSS) vulnerability in the /jobgroup/insert endpoint. The flaw is triggered by manipulating the Name argument, allowing a remote attacker to inject scripts that execute in a victim's browser. The CVSS 3.1 score is 3.5 (LOW)...

CVE-2026-94588

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in...

CVE-2026-94588

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in...

CVE-2026-94588

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in...

CVE-2026-94588

An argument injection vulnerability exists in Proxmox Mail Gateway (pmg-api) within the package changelog retrieval functionality . The root cause is improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. Exploitation requires authentic...

EUVD-2026-84163

In Proxmox pmg-api, an argument injection vulnerability exists in the package changelog retrieval functionality. This is caused by improper handling of user-supplied input passed to the underlying apt-get command when fetching package changelogs. It requires authentication but can be exploited in...

CVE-2026-94214 ST Engineering iDirect Evolution/Velocity WebServer Evolution Location Header redirect

A vulnerability was found in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack...