CVE-2026-105173: Improper Neutralization of Input During Web Page Generation

A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attac...

PT-2026-104695

Name of the Vulnerable Software and Affected Versions aidl affected versions not specified Description A missing permission check in aidl allows for a local escalation of privilege. This issue can be exploited by a malicious actor who has already obtained System privilege, and it requires no user...

Where Rules End and Judges Begin: Measuring the Judgment Boundary in Multi-Agent Systems Security

LLM-based multi-agent systems MAS engage tools, share memory, and delegate tasks, often encountering adversarial content. Current defenses for MAS are typically evaluated in isolation, focusing on one attack type at a time, which can lead to costly and hard-to-audit outcomes. This study organizes...

CVE-2026-78860

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-78860

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-20588: Out-of-bounds Write

In mtee, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11383899; Issue ID: MSV-9607...

PT-2026-106173

Name of the Vulnerable Software and Affected Versions sssd affected versions not specified Description A flaw allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the...

PT-2026-105988

Name of the Vulnerable Software and Affected Versions Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021 Description Front-end request desynchronization is possible in the proxy request forwarding component. When a request contains both Content-Length and...

Cargo Extension XSS

The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attack...

PT-2026-106203

Name of the Vulnerable Software and Affected Versions feelec-yishu feelcrm-os version 1.0.0 Description An issue in the UploadTicketFile endpoint within the file App/Feelcrm/Crm/Controller/UploadController.class.php allows for unrestricted file upload. This occurs when the cmd argument is...

PT-2026-104736

Name of the Vulnerable Software and Affected Versions sgl-project sglang versions prior to 0.5.22 Description A flaw in the HTTP Endpoint component allows remote attackers to cause the cleartext transmission of sensitive information. This occurs through the manipulation of the api key argument...

HarnessSecurity-Bench: Do Security Mechanisms Really Protect Coding Agent Harnesses?

Coding agent harnesses mediate tool use and authorize actions, yet their security mechanisms and runtime effects remain incompletely characterized. We present HarnessSecurity, the first systematic empirical study and benchmark of open- and closed-source coding agent harnesses. First, we derive a...

PT-2026-104663

A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function project create of the file gerapy/server/core/views.py of the component Project Management. The manipulation of the argument project name leads to path traversal. Remote exploitation of the attack is...

CVE-2026-105223: Improper Certificate Validation

maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...

CVE-2026-105230: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Impacted is an unknown function of the file delivery/deliverymyord.php. The manipulation of the argument deliverypersonid/orderid...

CVE-2026-105469: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file gettown.php of the component AJAX Endpoint. Executing a manipulation of the argument countryid/townid/cid/didval/cidv...

PT-2026-104721

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Impacted is an unknown function of the file delivery/deliverymyord.php. The manipulation of the argument delivery person id/order...

PT-2026-106258

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnerability affects unknown code of the file get town.php of the component AJAX Endpoint. Executing a manipulation of the argument...

PT-2026-104716

A vulnerability has been found in itsourcecode Online Admission System 1.0. Affected is an unknown function of the file /admin/key.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-78860

The Mercusys AC12 V2 is affected by a vulnerability that allows a local attacker to achieve arbitrary code execution . The root cause is identified as the storage of information in plaintext , which is associated with CWE-311 (Missing Encryption of Sensitive Data) and CWE-347 (Improper Verificati...