PT-2026-86240

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be use...

PT-2026-86165

PJSIP is a free and open source multimedia communication library written in C. Prior to commit 673b978, a remote out-of-bounds read and write can occur in the SDP negotiator when the remote payload-type map maintenance feature is enabled. assign pt and update map in pjmedia/src/pjmedia/sdp neg.c...

CVE-2026-78745

CVE-2026-78745 affects HiDPT/Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO , allowing a remote attacker to execute arbitrary code through the Android Debug Bridge (ADB) daemon (adbd) . The vulnerability is in the adbd component of the HiDPT Android platform used in these set-top box models. No CV...

PT-2026-86238

An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...

PT-2026-86257

An authenticated remote code execution RCE vulnerability in the admin config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request...

CVE-2025-67066

CVE-2025-67066 is a SQL Injection vulnerability in oasys sysoa version 1.0 . The flaw is located in the outtype parameter of the /outaddresspaging path, allowing a remote attacker to execute arbitrary code . No CVSS metrics are assigned, and no confirmed in-the-wild exploitation is documented in ...

PT-2026-86246

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...

CVE-2026-31020

In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attack...

CVE-2026-31020

CVE-2026-31020 affects DocsGPT 0.15.0 and below , where the application's custom prompt feature renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. This enables an unauthenticated attacker to inject malicious template expressions, resulting in a serve...

PT-2026-86247

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload...

PT-2026-85695

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process...

PT-2026-85574

TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attackers can submit POST and PUT requests to the /api/designer/v1/file-content endpoints to read arbitrary files or write malicious content to system path...

PT-2026-85706

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Complete cleanup after system-resume errors A failed system resume can leave the card unusable until reboot. usb audio resume jumps to err out when snd usb pcm resume or snd usb mixer resume fails. The error path...

Linux Distros Unpatched Vulnerability : CVE-2026-85044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social engineering to bypass web...

Linux Distros Unpatched Vulnerability : CVE-2026-80863

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/rxe: Fix OOB in freerdatomicresources freerdatomicresources iterates using qp-attr.maxdestrdatomic. Updating maxdestrdatomic before freeing the old array c...

MiracleLinux 9 : wget-1.21.1-11.el9_8 (AXSA:2026-1757:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1757:02 advisory. wget: GNU Wget: Heap buffer overflow via server-supplied filename leads to memory corruption CVE-2026-58471 wget: GNU Wget: Arbitrary code execution...

MiracleLinux 9 : gimp-3.0.4-4.el9_8.10 (AXSA:2026-1755:10)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1755:10 advisory. gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow CVE-2026-59090 gimp: GIMP: Arbitrary code execution via crafted TIF fil...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: gstreamer1-plugins-good (UTSA-2026-106462)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106462 advisory. GStreamer MRF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...

PT-2026-85383

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code...

PT-2026-85712

In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Remove crypto rng interface Since the crypto rng interface for hardware PRNGs is unused and is redundant with hwrng and the actual Linux RNG, it's being phased out. Most drivers for it were already removed. Go...