PT-2026-91136

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/formDiskPartition. Performing a manipulation of the argument devicename results in command injection. Remote exploitation of the attack is possible. The exploit has been made publi...

CVE-2026-90796: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-90697: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

CVE-2023-22631: Improper Neutralization of Argument Delimiters in a Command

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...

PT-2026-91456

Name of the Vulnerable Software and Affected Versions FFmpeg version 8.0.x Description A remote denial of service can be triggered through the manipulation of the duration or target duration arguments. This issue occurs within the parse playlist function located in the libavformat/hlsproto.c file...

RHEL 9 : ansible-core (RHSA-2026:67466)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67466 advisory. Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH...

MiracleLinux 8 : ansible-core-2.16.3-4.el8_10.ML.1 (AXSA:2026-1818:04)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1818:04 advisory. ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-11332 Tenable has extracted the preceding...

RHEL 9 : ansible-core (RHSA-2026:67467)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67467 advisory. Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH...

The vulnerability in the virtual machine of the cloud security platform Palo Alto Networks Cortex XDR Broker VM allows a attacker to execute arbitrary code.

The vulnerability of the virtual machine on Palo Alto Networks’ Cortex XDR Broker VM for cloud security platforms is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-90809: Improper Neutralization of Argument Delimiters in a Command

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool.guardcommand/ExecTool.spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulation leads to argument injection. It is possible to launch the attack remotely. T...

RHEL 10 : ansible-core (RHSA-2026:67465)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67465 advisory. Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SS...

CVE-2026-90606

CVE-2026-90606 is a buffer overflow in the boa component of Totolink A3002MU (firmware Hh-B20211125.1046). The vulnerable function is formIpv6Setup in the file /boafrm/formIpv6Setup; manipulation of the argument static_ipv6 triggers the overflow. The vulnerability is exploitable remotely with low...

CVE-2026-90593

A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::drawsubimage of the file src/image/imageraw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched remotely. The project was informed of the...

CVE-2026-90593 embedded-graphics image_raw.rs draw_sub_image integer overflow

A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::drawsubimage of the file src/image/imageraw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched remotely. The project was informed of the...

EUVD-2026-77091

A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::drawsubimage of the file src/image/imageraw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched remotely. The project was informed of the...

CVE-2026-90581

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been...

EUVD-2026-77073

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

CVE-2026-90581 cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been...

EUVD-2026-77060

A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexit...

EUVD-2026-77053

A vulnerability was determined in davenardella snap7 up to 1.4.3. The affected element is the function TSnap7MicroClient::opUpload of the file src/core/s7microclient.cpp. Executing a manipulation of the argument DataLen can lead to memory corruption. The attack can be executed remotely. The explo...