PT-2026-36587

Name of the Vulnerable Software and Affected Versions ARMember – Membership Plugin versions prior to 4.0.61 Description The ARMember – Membership Plugin for WordPress is susceptible to time-based blind SQL Injection, a technique where an attacker asks the database true/false questions and...

Exploit for CVE-2026-42167

\ CVE-2026-42167 POC Pre-Authentication Remote Code Executio...

angle:fuzz_spirv_transform: Crash in rx::ShaderInterfaceVariableInfoMap::add

Detailed Report: https://oss-fuzz.com/testcase?key=6086141119102976 Project: angle Fuzzing Engine: libFuzzer Fuzz Target: fuzzspirvtransform Job Type: libfuzzerasanangle Platform Id: linux Crash Type: UNKNOWN WRITE Crash Address: 0x77fb0d8d019c Crash State: rx::ShaderInterfaceVariableInfoMap::add...

kimageformats:kimgio_heif_fuzzer: Use-of-uninitialized-value in parse_sps_for_hvcC_configuration

Project: git://anongit.kde.org/kimageformats Detailed Report: https://oss-fuzz.com/testcase?key=5903431599718400 Project: kimageformats Fuzzing Engine: libFuzzer Fuzz Target: kimgioheiffuzzer Job Type: libfuzzermsankimageformats Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

angle:fuzz_spirv_parser: Crash in angle::spirv::ParseTypeFloat

Detailed Report: https://oss-fuzz.com/testcase?key=5471310913536000 Project: angle Fuzzing Engine: libFuzzer Fuzz Target: fuzzspirvparser Job Type: libfuzzerasanangle Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7bcb36320000 Crash State: angle::spirv::ParseTypeFloat...

u-boot:fuzz_efi_load_image: Crash in mbedtls_internal_sha256_process

Detailed Report: https://oss-fuzz.com/testcase?key=4840248550162432 Project: u-boot Fuzzing Engine: libFuzzer Fuzz Target: fuzzefiloadimage Job Type: libfuzzerasanu-boot Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000020401000 Crash State: mbedtlsinternalsha256process...

PT-2026-38389

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0 Description NodeVM's require.root path restriction can be bypassed using filesystem symlinks, allowing sandboxed code to load modules from outside the allowed root directory in the host context. This occurs because...

PT-2026-36508

Name of the Vulnerable Software and Affected Versions Open-SAE-J1939 versions prior to commit b6caf884df46435e539b1ecbf92b6c29b345bdfe Description An integer underflow exists in the SAE J1939 Read Transport Protocol Data Transfer function. This allows attackers to write to arbitrary memory by usi...

PT-2026-36315

Name of the Vulnerable Software and Affected Versions Apache MINA versions 2.1.0 through 2.1.11 Apache MINA versions 2.2.0 through 2.2.6 Description An insecure deserialization issue exists in the network application framework where the resolveClass function within AbstractIoBuffer contains a log...

PT-2026-36527

Name of the Vulnerable Software and Affected Versions GSVoIP web panel version 2.0.90 Description A Cross-Site Scripting XSS issue exists where the /painel/gateways.php/error endpoint fails to properly sanitize user-supplied input in the msg parameter. This allows a remote attacker to inject...

PT-2026-36543

Name of the Vulnerable Software and Affected Versions bandit versions 0.5.0 through 1.10.x Description An allocation of resources without limits or throttling allows unauthenticated remote denial of service via memory exhaustion. The fragment reassembly path in the handle frame/3 function within...

PT-2026-36320

Unauthenticated Cross Site Scripting XSS in Contact Form to Any API = 3.0.3 versions...

PT-2026-36532

Name of the Vulnerable Software and Affected Versions BurnInTest version 11.0 Build 1011 OSForensics version 11.1 Build 1007 PerformanceTest version 11.1 Build 1004 Description A flaw in the DirectIo64.sys component allows attackers to access kernel memory and escalate privileges. This is achieve...

PT-2026-36291

Name of the Vulnerable Software and Affected Versions Totolink A8000RU version 7.1cu.643 b20200521 Description An OS command injection issue exists in the CGI Handler component. A remote attacker can initiate an attack by manipulating the proto argument within the '/cgi-bin/cstecgi.cgi' endpoint...

PT-2026-36312

Name of the Vulnerable Software and Affected Versions Temporary Login plugin for WordPress versions prior to 1.0.1 Description An authentication bypass exists due to improper input validation in the maybe login temporary user function. The function fails to verify that the temp-login-token GET...

PT-2026-36500

Name of the Vulnerable Software and Affected Versions WhatsApp for iOS versions 2.25.8.0 through 2.26.15.72 WhatsApp for Android versions 2.25.8.0 through 2.26.7.10 Description Incomplete validation of AI rich response messages for Instagram Reels allows a user to trigger the processing of media...

PT-2026-36517

Name of the Vulnerable Software and Affected Versions Open Vehicle Monitoring System 3 OVMS3 version 3.3.005 Description A buffer overflow occurs in canformat pcap.cpp because the parser's phdr.len field is not properly validated. This allows remote attackers to cause a denial of service or...

PT-2026-36524

Name of the Vulnerable Software and Affected Versions Eprosima Micro-XREC-DDS Agent version 3.0.1 Description A remote attacker can cause a denial of service by sending a crafted packet to the MTU length field. Recommendations At the moment, there is no information about a newer version that...

PT-2026-36525

Name of the Vulnerable Software and Affected Versions Eprosima Micro-XREC-DDS Agent version 3.0.1 Description A remote attacker can cause a denial of service by sending a specially crafted packet containing an invalid value in any Boolean field. Recommendations At the moment, there is no...

PT-2026-36499

Name of the Vulnerable Software and Affected Versions WhatsApp for Windows versions prior to 2.3000.1032164386.258709 Description An attachment spoofing issue exists due to improper handling of hidden control characters, specifically embedded NUL bytes, in filenames. This allows maliciously...