PT-2026-111091

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper authentication may allow a remote attacker to gain unauthorized administrative access. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-108929: Improper Neutralization of Argument Delimiters in a Command

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely...

CVE-2026-108981: UNIX Symbolic Link (Symlink) Following

ngxcachepurge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application e.g., WordPress run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symli...

CVE-2026-108795: Improper Access Control

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

PT-2026-110429

Name of the Vulnerable Software and Affected Versions westboy CicadasCMS versions prior to 2431154dac8d0735e04f1fd2a3c3556668fc8dab Description An issue exists in the Template Management component within the TemplateController.input function of the /system/cms/template/input file. Remote...

CVE-2026-21123: Undefined Security Weakness

Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock...

CVE-2026-108820: Execution with Unnecessary Privileges

A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function memberagent.run in the library libs/agno/agno/team/defaulttools.py of the component Delegation Feature. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be...

CVE-2026-108808: Use of GET Request Method With Sensitive Query Strings

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...

CVE-2026-105081: Improper Link Resolution Before File Access

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to eva...

CVE-2026-21130: Undefined Security Weakness

Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges...

CVE-2026-108829: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The...

PT-2026-111087

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.98.0 Frappe ERPNext versions 16.x prior to 16.6.0 Description Missing input validation in certain endpoints allows remote authenticated attackers to perform SQL injection. By sending specially crafted...

PT-2026-111093

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper validation of file paths allows a remote attacker to read arbitrary host files and overwrite specific application files. Recommendations At the moment, there is no informatio...

CVE-2026-108896: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument 6rdprefix/6rdprefixlen results in os command injection. The attack can be launched remotely. The exploit has been made public and...

PT-2026-110910

Name of the Vulnerable Software and Affected Versions itsourcecode Online Admission System version 1.0 Description An issue exists in the processing of the /admin/sum.php endpoint. Remote manipulation of the ID argument allows for SQL injection, a technique where malicious SQL statements are...

CVE-2021-48011: Improper Limitation of a Pathname to a Restricted Directory

Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI decodes before path.join in serveStaticFile and serveDirectoryListin...

CVE-2026-21121: Undefined Security Weakness

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs...

PT-2026-110643

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 12.1.0 Progress MarkLogic Server versions prior to 11.3.7 Description An authorization flaw exists that allows a remote attacker with administrative privileges to access authentication material...

Linux net/tipc/bearer ipvlan_hard_header Heap Buffer Overflow

The vulnerability of the ipvlanhardheader function in the net/tipc/bearer.c component of the Linux operating system is related to the pointer being dereferenced after its expiration. Exploitation of this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...

Cisco NX-OS Information Disclosure

The vulnerability of the Cisco NX-OS operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to compromise the accessibility of protected information...