CVE-2026-113736 D-Link DHP-W610AV HNAP Login defaultvalue.xml login_prepare_hnap empty password

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function loginpreparehnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be...

EUVD-2026-106988

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function loginpreparehnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be...

Linux Distros Unpatched Vulnerability : CVE-2026-112941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .r...

Linux Distros Unpatched Vulnerability : CVE-2026-109245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdphttprequest in libfreerdp/utils/http.c that completes TLS...

Linux Distros Unpatched Vulnerability : CVE-2026-112912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.acce...

Linux Distros Unpatched Vulnerability : CVE-2026-112934

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user...

PT-2026-120808

Name of the Vulnerable Software and Affected Versions leomoon-studios wiki-go versions prior to 1.9.2 Description Remote manipulation of the documentPath argument within the DeleteComment function of the Comment Deletion Handler component leads to path traversal. Path traversal is a condition whe...

Data-Void Exploits in Web-Searching LLMs

Web-searching Large Language Models LLMs have changed how users seek online information: instead of sifting through ranked lists of links, users read synthesized answers. This shift creates a new LLM vulnerability: a data-void exploit. Disinformers publish their narratives in search spaces where...

PT-2026-120219

Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a link to the GET-based /logout endpoint. Attackers can lure victims into clicking an obfuscated, URL-encoded link that terminates their session,...

PT-2026-120836

Name of the Vulnerable Software and Affected Versions TOTOLINK EX200 version 5.2.3c.7200 Description A stack-based buffer overflow exists in the setStaticDhcpConfig function within the /cgi-bin/cstecgi.cgi endpoint of the lan.so component. This issue allows a remote attacker to trigger the flaw b...

Linux Distros Unpatched Vulnerability : CVE-2026-112026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the...

PT-2026-120217

Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that run into their own environment and read...

PT-2026-120175

vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense that allows remote attackers to constrain other clients' outputs by leaving stale allowed token ids rows. Attackers can submit concurrent constrained generate requests, including via unauthenticated /invocations, so...

PT-2026-120668

A weakness has been identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected is the function save folder/delete folder/delete file/file rename/save files of the file admin class.php of the component Folder Management. This manipulation of the...

PT-2026-120163

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login prepare hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty password in configuration file. The attack can be...

PT-2026-120647

The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat id as webhook:route name:delivery id and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix...

Linux Distros Unpatched Vulnerability : CVE-2026-112936

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock pat...

Linux Distros Unpatched Vulnerability : CVE-2026-113082

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory corruption in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a...

PT-2026-120166

A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure...

Linux Distros Unpatched Vulnerability : CVE-2026-113867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies,...