EUVD-2026-106990

A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure...

CVE-2026-113735

A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlinksetrootpwd of the file /mnt/mtd/aoniipc. Executing a manipulation can lead to use of weak credentials. The attack may be launched remotely. The attack requires a high level of...

CVE-2026-113706

A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/taskstore/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of t...

EUVD-2026-106988

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function loginpreparehnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be...

CVE-2026-113736 D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function loginpreparehnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be...

CVE-2026-113736

The D-Link DHP-W610AV (firmware version 1.02EUb03 ) is vulnerable to a critical flaw in the HNAP Login component. Specifically, the login_prepare_hnap function within the etc/defnodes/defaultvalue.xml file can be manipulated. By manipulating the Password argument, an attacker can cause the config...

PT-2026-120219

Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session,...

PT-2026-120669

A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Download. Such manipulation of the argument ID leads to sql...

PT-2026-120438

A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get model meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The atta...

Linux Distros Unpatched Vulnerability : CVE-2026-113309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. Chromiu...

PT-2026-120808

Name of the Vulnerable Software and Affected Versions leomoon-studios wiki-go versions prior to 1.9.2 Description Remote manipulation of the documentPath argument within the DeleteComment function of the Comment Deletion Handler component leads to path traversal. Path traversal is a condition whe...

Data-Void Exploits in Web-Searching LLMs

Web-searching Large Language Models LLMs have changed how users seek online information: instead of sifting through ranked lists of links, users read synthesized answers. This shift creates a new LLM vulnerability: a data-void exploit. Disinformers publish their narratives in search spaces where...

Linux Distros Unpatched Vulnerability : CVE-2026-113122

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML...

PT-2026-120218

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route resources.taskruns.$runParam.replay and looks up the run by friendlyId alone. A remote attacker who knows a victim's run friendlyId can replay it into an environment o...

PT-2026-120836

Name of the Vulnerable Software and Affected Versions TOTOLINK EX200 version 5.2.3c.7200 Description A stack-based buffer overflow exists in the setStaticDhcpConfig function within the /cgi-bin/cstecgi.cgi endpoint of the lan.so component. This issue allows a remote attacker to trigger the flaw b...

Linux Distros Unpatched Vulnerability : CVE-2026-113193

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page...

PT-2026-120217

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read...

Linux Distros Unpatched Vulnerability : CVE-2026-112912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.acce...

Linux Distros Unpatched Vulnerability : CVE-2026-112934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user...

PT-2026-120175

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense that allows remote attackers to constrain other clients' outputs by leaving stale allowed token ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so...