CVE-2026-108981: UNIX Symbolic Link (Symlink) Following

ngxcachepurge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application e.g., WordPress run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symli...

CVE-2026-108791: Improper Limitation of a Pathname to a Restricted Directory

A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateController.input of the file /system/cms/template/input of the component Template Management. This manipulation of the argument filePath causes path traversal. It ...

CVE-2026-21134: Undefined Security Weakness

Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information...

CVE-2026-21130: Improper Input Validation

Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.1 allows local attackers to launch an arbitrary activity with Samsung Checkout privileges...

CVE-2026-21118: Undefined Security Weakness

Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage...

CVE-2026-108821: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has bee...

CVE-2026-83536: Uncontrolled Resource Consumption

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

CVE-2026-108820: Execution with Unnecessary Privileges

A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function memberagent.run in the library libs/agno/agno/team/defaulttools.py of the component Delegation Feature. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be...

CVE-2026-105081: Improper Link Resolution Before File Access

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to eva...

CVE-2026-108813: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMSDownload.php. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about th...

CVE-2026-108814: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMSBanner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this...

Cisco Meraki

The vulnerability of Cisco Meraki network device software relates to the implementation of incorrect control flow. Exploiting this vulnerability can allow a remote attacker to compromise the accessibility of protected information...

GnuTLS check_for_unknown_exts MITM DoS

The vulnerability of the checkforunknownexts function in the GnuTLS cryptographic library is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor to perform a MITM attack or cause service denial...

SonicWall SMA1000 SRF Unauthorized Access

The vulnerability of the Appliance WorkPlace microprogramming-based network interface of SonicWall SMA1000 relates to the possibility of bypassing access control mechanisms. Exploiting this vulnerability allows a malicious actor to execute an SRF attack and gain unauthorized access to protected...

Cisco NX-OS Information Disclosure

The vulnerability of the Cisco NX-OS operating system is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to compromise the accessibility of protected information...

CVE-2026-108826: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zendbperform in the library includes/modules/payment/paypaldp.php of the component PayPal IPN Handler. Performing a manipulation of the argument txnid results in sql injection. The attack can be initiated remotely. The...

PT-2026-110453

Name of the Vulnerable Software and Affected Versions libsimba.heifdec.media.samsung.so versions prior to SMR Oct-2026 Release 1 Description Improper input validation occurs during the parsing of sheifd, which may allow a local attacker to execute arbitrary code. Recommendations Update...

HPESBNS05148 rev.1 - HPE NonStop Servers, Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, memory corruption, Buffer Overflow, Stack Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. NONSTOP KERNEL T9050 - T9050L02^BBP, T9050L02^BBS EXPAND T9057 - T9057L02^AIG and earlier XDR Streams T0248 - T0248L01^AAD an...

EulerOS 2.0 SP11 : python-filelock (EulerOS-SA-2026-4276)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

CentOS Linux 8.5 [TuxCare] Security Update: sudo / sudo-devel (CENTOS8.5:CLSA-2026:1791794851)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791794851 advisory. - A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailin...