EulerOS Virtualization 2.10.1 : cifs-utils (EulerOS-SA-2026-3829)

According to the versions of the cifs-utils packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looki...

CVE-2026-94151: Missing Authentication for Critical Function

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched...

The vulnerability of the setLanCfg function in the microprogramming software of TOTOLINK A3300R allows a intruder to execute arbitrary commands.

The vulnerability of the setLanCfg function in TOTOLINK A3300R router microprogramming systems lies in the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-94096: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/networktools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched...

CVE-2026-94101: Buffer Copy without Checking Size of Input

A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlanloadformuci of the file /usr/bin/routerd. The manipulation of the argument wannum leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has be...

CVE-2026-94102: URL Redirection to Untrusted Site

A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The...

CVE-2026-94532: Authorization Bypass Through User-Controlled Key

lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information including mobile numbers, email addresse...

CVE-2026-49811: Incorrect Permission Assignment for Critical Resource

Dell Command | Monitor DCM, versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

CVE-2026-78806

An issue in the Matter Standard Specification-Implementation gap v1.5.1 (Matter Project Chip V1.5.1) allows a local attacker to obtain sensitive information . The vulnerability exists within the PerformCommissioningStep function in the ChipDeviceController.cpp component. No specific exploit detai...

CVE-2026-94403: Untrusted Pointer Dereference

A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub140001AF0 in the library ene.sys of the component IOCTL Handler. This manipulation causes untrusted pointer dereference. The attack can only be executed locally. The exploit has been made available to the...

The vulnerability of the NPM packet manager’s vm2 library, related to a flaw in the data protection mechanism, allows attackers to execute arbitrary code.

The vulnerability of the NPM packet manager’s library vm2 is related to a breach in data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

CVE-2026-94142: Write-what-where Condition

A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the function sub1105C of the file BSHWMIO64W10.sys of the component IOCTL Handler. Such manipulation of the argument PhysicalAddress leads to write-what-where...

CVE-2026-94103: Improper Control of Generation of Code

A vulnerability has been found in RooCMS up to 1.2.2/1.3.4/1.4RC2. This impacts the function eval of the file roocms/sitepagePHP.php of the component Frontend Rendering. Such manipulation of the argument content leads to code injection. The attack can be launched remotely. The exploit has been...

CVE-2026-94540: Missing Authentication for Critical Function

DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived content, and persist an attacker-selected paired identity by interacting with the application's local service without any pairing confirmation or user...

CVE-2026-94216: URL Redirection to Untrusted Site

A vulnerability was determined in ST Engineering iDirect Evolution and Velocity WebServer Evolution up to 20260717. This vulnerability affects the function authorize of the file /usr/sbin/webserver of the component HTTP Header Handler. Executing a manipulation of the argument Success can lead to...

CVE-2026-91921: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...

CVE-2026-94138: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...

CVE-2026-94110: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...

CVE-2026-94100: Buffer Copy without Checking Size of Input

A weakness has been identified in Netcore NBR200V2 1.3.241127.071246. Impacted is the function wanconfigsetvlan of the file /usr/bin/routerd of the component WAN VLAN Reconfiguration. Executing a manipulation of the argument vlanwanX.ports can lead to buffer overflow. The attack may be performed...

VulnCheck KEV: CVE-2026-92229

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value...