306814 matches found
PT-2026-104718
A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of the argument MODULE PAYMENT INSTALLED leads to code injection. The attack can be executed remotely...
CVE-2026-105438: Server-Side Request Forgery (SSRF)
A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /xgeneralassemblecontrol/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack...
CVE-2026-105223: Improper Certificate Validation
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig and parseKubeconfigFile when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer token...
PT-2026-105990
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools launched by the application is insufficient. Before executing a helper tool, the application only verifies that the file carries a valid Authenticode...
Backdooring Sparse Autoencoders
Sparse autoencoders SAEs are increasingly used not only to interpret language models but also to intervene on their internal representations. We show that this creates a supply-chain attack surface: a maliciously modified SAE can induce attacker-chosen behavior when inserted into the forward pass...
CVE-2026-78862
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board PCB...
PT-2026-106192
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...
CVE-2026-78860
The Mercusys AC12 V2 is affected by a vulnerability that allows a local attacker to achieve arbitrary code execution . The root cause is identified as the storage of information in plaintext , which is associated with CWE-311 (Missing Encryption of Sensitive Data) and CWE-347 (Improper Verificati...
PT-2026-106173
Name of the Vulnerable Software and Affected Versions sssd affected versions not specified Description A flaw allows a local user to cause a Denial of Service DoS by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the...
CVE-2026-78861
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...
ROS-20261005-73-0026
The vulnerability of the Rsync file transfer and synchronization utility relates to the bypassing of authentication processes through spoofing. Exploiting this vulnerability allows a malicious actor to circumvent existing security mechanisms remotely...
PT-2026-104723
A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file delivery/deliverysignup.php of the component Registration Page. This manipulation of the...
Node.js HTTP Agent Data Compromise
The vulnerability of the Node.js software platform’s HTTP agent is related to synchronization errors when using shared resources. Exploiting this vulnerability allows a remote attacker to compromise the integrity of the protected information...
PT-2026-104736
Name of the Vulnerable Software and Affected Versions sgl-project sglang versions prior to 0.5.22 Description A flaw in the HTTP Endpoint component allows remote attackers to cause the cleartext transmission of sensitive information. This occurs through the manipulation of the api key argument...
Cisco ASA Insufficient Session Expiration (CVE-2021-1501)
A vulnerability in the SIP inspection engine of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a crash and reload of an affected device, resulting in a denial of service DoS condition.The...
CVE-2026-105232: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file delivery/deliverysignup.php of the component Registration Page. This manipulation of the...
PT-2026-104695
Name of the Vulnerable Software and Affected Versions aidl affected versions not specified Description A missing permission check in aidl allows for a local escalation of privilege. This issue can be exploited by a malicious actor who has already obtained System privilege, and it requires no user...
Where Rules End and Judges Begin: Measuring the Judgment Boundary in Multi-Agent Systems Security
LLM-based multi-agent systems MAS engage tools, share memory, and delegate tasks, often encountering adversarial content. Current defenses for MAS are typically evaluated in isolation, focusing on one attack type at a time, which can lead to costly and hard-to-audit outcomes. This study organizes...