PT-2026-26619

D-Link DIR-513 Web Service formEasySetPassword stack-based overflow CVE: CVE-2026-4486 PT-Identifier: PT-2026-26619 Vendor: D-link Product: DIR-513 CVSS: 8.7 Credits: AttackingLin VulDB User Description: A vulnerability was found in D-Link DIR-513 1.10. This affects the function formEasySetPasswo...

PT-2026-26623

A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/websHostFilter. This manipulation causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized...

PT-2026-26751

Name of the Vulnerable Software and Affected Versions Vikunja affected versions not specified Description An authenticated user can access task comments without proper authorization checks. Specifically, an attacker can read any task comment by ID, even if they do not have access to the associate...

📄 OpenEMR Remote Code Execution

OpenEMR versions prior to 8.0.0.1 contain multiples command injection vulnerabilities in the backup functionality that can be exploited by authenticated attackers. CVE-2026-32238 - Remote Code Execution in OpenEMR Weakness CWE-78 : Improper Neutralization of Special Elements used in an OS Command...

PT-2026-26766

Summary The Gallery plugin's saveSort.json.php endpoint passes unsanitized user input from $ REQUEST'sections' array values directly into PHP's eval function. While the endpoint is gated behind User::isAdmin, it has no CSRF token validation. Combined with AVideo's explicit SameSite=None session...

Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments

An authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in the API URL with a task they do have access to...

PT-2026-26784

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0 Description A flaw exists in AVideo that allows for stored cross-site scripting XSS through markdown link injection. The fix for a previous issue introduced a custom class, ParsedownSafeWithLinks,...

Exploit for OS Command Injection in Php

╔═══════════════════════════════════════════════════════╗...

assimp:assimp_fuzzer: Crash in Assimp::MDLImporter::ProcessFrames_3DGS_MDL7

Project: https://github.com/assimp/assimp.git Detailed Report: https://oss-fuzz.com/testcase?key=6077223328350208 Project: assimp Fuzzing Engine: libFuzzer Fuzz Target: assimpfuzzer Job Type: libfuzzerubsanassimp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x58c4b71f6002 Crash Stat...

hostap:pasn-init: Heap-buffer-overflow in wpa_pasn_auth_rx

Project: git://w1.fi/srv/git/hostap.git Detailed Report: https://oss-fuzz.com/testcase?key=6425366330933248 Project: hostap Fuzzing Engine: libFuzzer Fuzz Target: pasn-init Job Type: libfuzzerasani386hostap Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0xf4c006ac Crash...

pcapplusplus:FuzzTargetNg: Use-of-uninitialized-value in pcpp::IDnsResource::decodeName

Project: https://github.com/seladb/PcapPlusPlus.git Detailed Report: https://oss-fuzz.com/testcase?key=6299230322098176 Project: pcapplusplus Fuzzing Engine: libFuzzer Fuzz Target: FuzzTargetNg Job Type: libfuzzermsanpcapplusplus Platform Id: linux Crash Type: Use-of-uninitialized-value Crash...

harfbuzz:hb-vector-fuzzer: Heap-use-after-free in hb_vector_paint_glyph

Project: https://github.com/harfbuzz/harfbuzz.git Detailed Report: https://oss-fuzz.com/testcase?key=6065382371950592 Project: harfbuzz Fuzzing Engine: libFuzzer Fuzz Target: hb-vector-fuzzer Job Type: libfuzzerasani386harfbuzz Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash...

PT-2026-26287

We're not migrating to Veeam B&R 13.0.1 until the end of the year, as Veeam B&R is supported until 01 Feb 2027, and we're not find of adopting applications before a couple of version releases have been made. We noticed Action1 appears to be incorrectly assigning CVE's affecting Veeam B&R 13.0.1.x...

PT-2026-26489

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 26.0 Description AVideo, an open source video platform, contains an unauthenticated SQL injection flaw in the objects/category.php file within the getAllCategories method. The doNotShowCats request parameter undergoes...

PT-2026-26297

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 2.1.53 Description Claude Code is an agentic coding tool that experienced a loading order issue in its settings loader. The software resolved the permission mode from settings files, such as the...

PT-2026-26352

Name of the Vulnerable Software and Affected Versions M365 Copilot affected versions not specified Description An improper neutralization of special elements used in a command 'command injection' exists in M365 Copilot. This allows an unauthorized attacker to disclose information over a network...

PT-2026-26487

Name of the Vulnerable Software and Affected Versions fast-xml-parser versions 4.0.0-beta.3 through 5.5.6 Description The DocTypeReader in fast-xml-parser incorrectly uses JavaScript truthy checks to evaluate maxEntityCount and maxEntitySize configuration limits. When a developer sets either limi...

PT-2026-26301

Summary The listFiles.json.php endpoint accepts a path POST parameter and passes it directly to glob without restricting the path to an allowed base directory. An authenticated uploader can traverse the entire server filesystem by supplying arbitrary absolute paths, enumerating .mp4 filenames and...

CVE-2026-216670

PT-2026-26287 associates CVE-2026-216670 with Veeam Backup & Replication (Veeam B&R). The entry notes fixes: CVEs resolved in Veeam B&R 12.3.2.4165 (released 12 Mar 2026) and in 13.0.1.x (also released 12 Mar 2026). No root-cause details are provided in the connected document, only that these CVE...

PT-2026-26372

Name of the Vulnerable Software and Affected Versions Microsoft Bing Images affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized remote attacker to execute arbitrary code over a network. The...