CVE-2026-108929: Improper Neutralization of Argument Delimiters in a Command

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely...

CVE-2026-108896: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument 6rdprefix/6rdprefixlen results in os command injection. The attack can be launched remotely. The exploit has been made public and...

EulerOS 2.0 SP11 : dhcp (EulerOS-SA-2026-4221)

According to the versions of the dhcp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a query to a specially crafted zone...

Amazon Linux 2023 : libX11, libX11-common, libX11-devel (ALAS2023-2026-3179)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3179 advisory. A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the keysymmap. CVE-2026-88806 Tenable has extracted the preceding description block...

Amazon Linux 2 : awscli (ALAS-2026-3966)

The version of awscli installed on the remote host is prior to 1.18.147-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3966 advisory. Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has...

EulerOS 2.0 SP13 : python-filelock (EulerOS-SA-2026-4184)

"According to the versions of the python-filelock package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition...

CVE-2026-21121: Undefined Security Weakness

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs...

Amazon Linux 2 : openssl-snapsafe (ALASOPENSSL-SNAPSAFE-2026-013)

The version of openssl-snapsafe installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2OPENSSL-SNAPSAFE-2026-013 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes...

CVE-2026-109566: Use of Hard-coded Credentials

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-create...

PT-2026-111097

Name of the Vulnerable Software and Affected Versions IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 Description A remote attacker can cause a denial of service by triggering uncontrolled resource consumption. Recommendations At the moment, there is no information about a newer versio...

CVE-2026-108782: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulati...

CVE-2026-21115: Undefined Security Weakness

Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-109638: Improper Neutralization of Special Elements used in an SQL Command

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from...

PT-2026-110634

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 3.0.2patch3 Description An issue exists in the XML-RPC component within the userLogin function of the xmlrpc.php file. This flaw allows a remote attacker to perform SQL injection, which is a technique used to...

PT-2026-110909

Name of the Vulnerable Software and Affected Versions itsourcecode Baptism Information Management System version 1.0 Description A SQL injection flaw exists in the pbaptism.php file. This issue occurs when the b id argument is manipulated, allowing a remote attacker to execute arbitrary SQL...

PT-2026-110797

Name of the Vulnerable Software and Affected Versions Netcore NR268 version 1.7.121109 Description Cross site scripting occurs in the Web UI component due to improper handling of the title, note, URL, and content arguments within the eval function of the '/router/l7 call board user set.cgi'...

PT-2026-111091

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.1 Description Improper authentication may allow a remote attacker to gain unauthorized administrative access. Recommendations At the moment, there is no information about a newer version that...

PT-2026-110430

Name of the Vulnerable Software and Affected Versions ngx cache purge versions prior to 3.0.4 Description An issue exists where file deletion is possible via a symlink attack when nginx and a served application, such as WordPress, operate under the same user account. This occurs because the ngx...

PT-2026-110453

Name of the Vulnerable Software and Affected Versions libsimba.heifdec.media.samsung.so versions prior to SMR Oct-2026 Release 1 Description Improper input validation occurs during the parsing of sheifd, which may allow a local attacker to execute arbitrary code. Recommendations Update...

CVE-2026-108831: Use of Hard-coded Credentials

A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been...