cats cats-14.0.0

CATS documentation is available at https://endava.github.io/cats/ REST API fuzzer and negative testing tool. Run thousands of self-healing API tests within minutes with no coding effort! Comprehensive : tests are generated automatically based on a large number scenarios and cover every field and...

The vulnerability in the script/cgi-bin/dropbox.cgi of the CGI Handler component of the D-Link DNS-340L network storage software allows a hacker to execute arbitrary code.

The vulnerability of the /cgi-bin/dropbox.cgi script of the CGI Handler component in the D-Link DNS-340L network storage software is related to the lack of measures taken at the administrative level to ensure data cleanup. Exploiting this vulnerability could allow an attacker operating remotely t...

PT-2026-86819

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft ...

PT-2026-86736

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 clien...

PT-2026-86635

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1 20251110. This vulnerability affects the...

PT-2026-86634

A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1 20251110. This affects the function...

VulnCheck KEV: CVE-2025-14208

A security flaw has been discovered in D-Link DIR-823X up to 20250416. This affects the function sub415028 of the file /goform/setwansettings. The manipulation of the argument pppusername results in command injection. It is possible to launch the attack remotely. The exploit has been released to...

PT-2026-86652

A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml commands, the malicious module name, containing shell...

CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN

Symptoms - Issue: Improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway. This issue received the ID CVE-2026-85102 with CVSS: 9.8. For Site-to-Site VPN , the issue affects Security gateways tha...

Linux Distros Unpatched Vulnerability : CVE-2026-79678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the...

Linux Distros Unpatched Vulnerability : CVE-2026-18707

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server could allow an authenticated user, including one with no assigned privileges, to cause the server process to terminate unexpectedly b...

CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution

Symptoms - Issue: A heap overflow in the VPN certificate ASN.1 decoding flow may allow an attacker to remotely execute arbitrary code on the Security Management Server and Security Gateway. Clarification: All Security Management Server deployments are vulnerable, regardless of configuration, and...

Linux Distros Unpatched Vulnerability : CVE-2026-19843

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name DN into ...

Linux Distros Unpatched Vulnerability : CVE-2026-80813

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/...

Zimbra Collaboration Suite 10.1.19 Command Injection

Zimbra Collaboration Suite versions 10.1.1 through 10.1.19 suffer from command injection via SMTP log poisoning. https://packetstorm.news/download/230686...

VulnCheck KEV: CVE-2025-60687

An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619B20230130 within the cstecgi.cgi binary sub41EC68 function. The binary reads the "imei" parameter from a web request and verifies only that it is 15 characters long. The parameter is the...

PT-2026-86684

A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform event pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack...

PT-2026-86822

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit...

PT-2026-86758

A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...

The vulnerability of the Util-linux command-line utility suite relates to deficiencies in handling error situations, allowing attackers to exploit their privileges.

The vulnerability of the Util-linux command-line utility package is related to deficiencies in handling error situations. Exploiting this vulnerability can allow an attacker to increase their privileges...