PT-2026-98826

Name of the Vulnerable Software and Affected Versions D-Link DAP-2610 versions prior to 2.06B08r099 Description An authenticated command injection issue exists within the web interface at the '/index.xgi' endpoint. An attacker with authenticated access can exploit specific parameters to execute...

PT-2026-98878

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 16.4.0 Description The application fails to perform numeric validation on dimension width, height, ratio, and filesize values provided via the Batch Manager filter URL in the 'admin/batch manager.php' endpoint. These...

PT-2026-99072

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.7 Description An issue exists where a low-privileged authenticated user can utilize the API v2 to execute update operations that are typically restricted within the user interface. This occurs because the API...

Linux Distros Unpatched Vulnerability : CVE-2026-98113

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: rate limit unmapped SID errors A client can include many structurally valid but unmapped SIDs in a DACL. Logging every mapping failure lets one request...

PT-2026-98822

Name of the Vulnerable Software and Affected Versions OpenStack Glance affected versions not specified Description A Server-Side Request Forgery SSRF issue exists in the Image API v2. When the show multiple locations configuration option is enabled in glance-api.conf, an authenticated attacker ca...

Security Bulletin: IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service [CVE-2026-84414]

Summary IBM i is vulnerable to allowing a local authenticated attacker to change the ownership of certain files due to running with excessive permissions CVE-2026-84414 in Network Authentication Service NAS as described in the vulnerability details section. Vulnerability Details...

CVE-2026-95699

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and...

CVE-2026-87118

The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticated attacker with adjacent network access could submit crafted command data that corrupts memory, potentially disrupting authentication state or causing the...

CVE-2026-14442

Brocade SANnav versions before 3.0.1a are susceptible to an information exposure vulnerability in the job scheduling component . When scheduled support save jobs or related operational tasks are executed, the system fails to properly mask sensitive parameters, leading to the logging of cleartext ...

CVE-2026-95699

The iSteamX mobile application (MrSteam) contains an improper isolation or compartmentalization vulnerability due to a flaw in its AWS policy . This policy allowed authenticated users to access wildcard MQTT topics , potentially exposing other users' device data and profile information. An attack...

CVE-2026-95699 MrSteam iSteamX Improper Isolation or Compartmentalization

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and...

EUVD-2026-86468

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and...

EUVD-2026-86462

The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticated attacker with adjacent network access could submit crafted command data that corrupts memory, potentially disrupting authentication state or causing the...

CVE-2026-48541

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name containing...

UBUNTU-CVE-2026-96883

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in...

EUVD-2026-86451

The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another clie...

CVE-2026-77967 Botslab G980H Dashcams Authentication Bypass by Capture-replay

The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another clie...

CVE-2026-77967

The Botslab G980H dash camera firmware is vulnerable to an authentication bypass due to a lack of freshness verification or client association checks for authentication values. An unauthenticated attacker with adjacent network access can capture a valid authentication value and perform a capture-...

EUVD-2026-86448

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

CVE-2026-48543 Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...