EUVD-2026-88104

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function mergesplitfile of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument splitfilepath results in command injection. The attack is possible to be...

Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilities (CVE-2026-19032, CVE-2026-83557)

Summary Multiple vulnerabilities are found in dependent open source libraries used in IBM Quantum Safe Explorer code base. IBM Quantum Safe Explorer has addressed these vulnerabilities by updating the versions of the affected libraries. Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTION:...

CVE-2026-101007 aaPanel BaoTa Database Backup database.py InputSql os command injection

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2026-101007 aaPanel BaoTa Database Backup database.py InputSql os command injection

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

EUVD-2026-88103

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2026-101007

A vulnerability exists in aaPanel BaoTa up to version 11.8.0 , specifically within the Database Backup Handler component. The flaw is located in the InputSql function of the class/database.py file. By manipulating the Password argument, an attacker can achieve remote os command injection . Public...

CVE-2026-101003

A flaw was found in Mongoose. A remote attacker can trigger a stack-based buffer overflow by sending specially crafted network messages to the MQTT broker component. This flaw could lead to a Denial of Service DoS condition by crashing the application...

CVE-2026-101004

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-101003

A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The...

CVE-2026-101002

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/networktools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. Th...

CVE-2026-101006

The software Frappe HR (up to version 16.15.0 ) is vulnerable to a Permission Validation flaw located in the file hrms/api/__init__.py. Specifically, the functions get_expense_claims, get_shift_requests, and get_attendance_requests are susceptible to incorrect authorization when the employee argu...

CVE-2026-93000 SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...

EUVD-2026-88093

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-101005

A server-side request forgery (SSRF) vulnerability exists in October CMS versions up to 4.3.4 . The flaw is located in the validateExternalImageHost function within the System/Classes/ResizeImages.php file of the SSRF Protection component. An unauthenticated remote attacker can exploit this vulne...

CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-101004

A security vulnerability exists in notionnext-org NotionNext up to version 4.10.10 within the Authentication Guard component. The flaw resides in the cleanCache function of the pages/api/cache.js file, where manipulating the token argument leads to missing authentication . This allows for remote ...

CVE-2026-101004 notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-101004 notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...