CVE-2026-21126: Undefined Security Weakness

Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-108777: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. Th...

CVE-2026-108896: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument 6rdprefix/6rdprefixlen results in os command injection. The attack can be launched remotely. The exploit has been made public and...

CVE-2026-108889: Exposed IOCTL with Insufficient Access Control

A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub14000443C in the library LWBilling64.sys of the component IOCTL Process Termination. Executing a manipulation of the argument Pid can lead to exposed ioctl with insufficient access...

CVE-2026-108929: Improper Neutralization of Argument Delimiters in a Command

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname can lead to argument injection. The attack can be launched remotely...

CVE-2026-108981: UNIX Symbolic Link (Symlink) Following

ngxcachepurge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application e.g., WordPress run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symli...

CVE-2026-108906: Out-of-bounds Read

A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filterarpputfilecgi of the file /router/filterarpputfile.cgi. The manipulation of the argument putfile leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed ...

CVE-2026-108820: Execution with Unnecessary Privileges

A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function memberagent.run in the library libs/agno/agno/team/defaulttools.py of the component Delegation Feature. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be...

CVE-2026-108788: Undefined Security Weakness

A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted element is the function spawn of the component Sandbox. Executing a manipulation of the argument Profile can lead to sandbox issue. It is possible to launch the attack on the local host. The exploit has...

CVE-2026-108782: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is the function CommonServiceImpl.getAutoList of the file src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java of the component Autocomplete Handler. Executing a manipulati...

CVE-2026-108784: Undefined Security Weakness

A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function AlipayServiceImpl.pay of the file com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the component Payment Endpoint. The manipulation of the argument totalamount results in business logi...

CVE-2026-108831: Use of Hard-coded Credentials

A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown code of the file html/demos/admin.js of the component Admin API. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been...

CVE-2026-108814: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in SEMCMS up to 5.0. This impacts an unknown function of the file SEMCMSBanner.php. Executing a manipulation can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this...

CVE-2026-108829: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The...

CVE-2026-108808: Use of GET Request Method With Sensitive Query Strings

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...

CVE-2026-108795: Improper Access Control

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

CVE-2026-109566: Use of Hard-coded Credentials

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-create...

CVE-2026-108361: Time-of-check Time-of-use (TOCTOU) Race Condition

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully...

PT-2026-111098

Name of the Vulnerable Software and Affected Versions IBM Aspera Enterprise WebApps versions 1.0.0 through 1.0.6 Description A local attacker can obtain sensitive information because a service account has been assigned excessive permissions. Recommendations At the moment, there is no information...

CVE-2026-108927: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in itsourcecode Baptism Information Management System 1.0. This vulnerability affects unknown code of the file pbaptism.php. This manipulation of the argument bid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made availab...