PT-2026-91423

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A path traversal issue allows a remote authenticated attacker to read, write, or delete arbitrary files. Path traversal is a flaw that allows an attacker to access files and...

CVE-2026-82779: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in CONPROSYS TM Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82795: Improper Neutralization of Input During Web Page Generation

SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91721

Name of the Vulnerable Software and Affected Versions IBM i Access Family versions 1.1.2.0 through 1.1.9.15 Description IBM i Access Client Solutions contains an issue where improper validation of user-supplied input in the STRPCCMD CL command allows an authenticated user to execute arbitrary...

CVE-2026-14275: Improper Neutralization of Special Elements used in an OS Command

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a STRPCCMD CL command...

PT-2026-91723

Name of the Vulnerable Software and Affected Versions IBM i Access Family versions 1.1.2.0 through 1.1.9.15 Description An authenticated user can execute arbitrary commands with normal user privileges on the system. This occurs due to improper validation of user-supplied input within a session...

CVE-2026-7208: Concurrent Execution using Shared Resource with Improper Synchronization

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows authenticated attackers to interrupt active diagnostic processes by concurrently deleting output files written to predictable paths under the diagnostic directory. Attackers can...

CVE-2026-16432: Improper Restriction of XML External Entity Reference

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage PxXMLInput operator could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity XXE injection...

CVE-2026-82426: Improper Limitation of a Pathname to a Restricted Directory

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...

CVE-2026-55416: Improper Neutralization of Special Elements used in an SQL Command

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reportsconfig permission can place attacker-controlled SQL fragments in the sql, from, where, and groupby fields of a Custom Reports configuration processed by...

CVE-2026-90937: Improper Neutralization of CRLF Sequences

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs containing literal newlines that are written verbatim into vhost config files duri...

CVE-2026-90930: Improper Link Resolution Before File Access

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link...

PT-2026-91206

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link...

CVE-2023-50461

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...

PT-2026-91095

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91081

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in CONPROSYS PAC Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91098

SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91100

SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-91104

🚨 CRITICAL JOOMLA SECURITY ALERT A CVSS 9.4 RCE vulnerability — CVE-2026-85192 — has been identified in the Regular Labs Conditional Content Pro plugin for Joomla. ⚠️ Affected versions: 1.0.0 – 7.1.0 The flaw can allow a privileged Joomla user to inject a malicious inline PHP condition into articl...

PT-2026-91135

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to. This issue affects Apache Doris: from 3.1.0 through 3.1., from 4.0.0 through 4.0.7, and from 4.1.0 through 4.1.3. Users are recommend...