PT-2026-110877

A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user record.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be...

PT-2026-110873

Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description Improper privilege management in IBM Db2 for Linux, UNIX, and Windows, including DB2 Connect Server, could allow a local attacker to gain elevated...

PT-2026-110798

A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public a...

PT-2026-110858

Name of the Vulnerable Software and Affected Versions Edimax BR-6208AC version 1.32 Description Remote command injection is possible due to improper processing of the /goform/formAutoFWupgrade endpoint. An attacker can execute arbitrary commands by manipulating the tftpsIP argument. Recommendatio...

PT-2026-110797

Name of the Vulnerable Software and Affected Versions Netcore NR268 version 1.7.121109 Description Cross site scripting occurs in the Web UI component due to improper handling of the title, note, URL, and content arguments within the eval function of the '/router/l7 call board user set.cgi'...

PT-2026-110857

A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and...

PT-2026-110738

Grav Login OAuth plugin grav-plugin-login-oauth before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic . username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess ...

PT-2026-110747

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page th...

PT-2026-110800

🚨 CVE-2026-85963 Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests,...

PT-2026-110913

Name of the Vulnerable Software and Affected Versions Apache Allura versions prior to 1.22.0 Description An OAuth1 Request Replay Attack issue exists in Apache Allura. This allows an attacker to reuse a previously captured request to perform unauthorized actions. Recommendations Upgrade to versio...

ROS-20261012-73-0213

The vulnerability in the kernel-lt is related to the use of memory after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261012-73-0040

The vulnerability in the kernel-lt is related to the use of memory after it has been freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-109566: Use of Hard-coded Credentials

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-create...

CVE-2026-108929: Improper Neutralization of Argument Delimiters in a Command

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely...

CVE-2026-108927: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulation of the argument bid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made availab...

CVE-2021-48011: Improper Limitation of a Pathname to a Restricted Directory

Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI decodes before path.join in serveStaticFile and serveDirectoryListin...

CVE-2026-108361: Time-of-check Time-of-use (TOCTOU) Race Condition

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully...

CVE-2026-104364: Improper Input Validation

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation...

CVE-2026-83536: Uncontrolled Resource Consumption

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

CVE-2026-108909: Cross-Site Request Forgery (CSRF)

A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiated remotely. The exploit has been released to the public a...