EUVD-2026-78167

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access...

CVE-2026-90841

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

PT-2026-92461

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description A flaw in the API endpoint allows an unauthenticated remote attacker to access sensitive information. This data retrieval could potentially be used to...

PT-2026-91867

Name of the Vulnerable Software and Affected Versions WP Directory Kit WordPress plugin versions prior to 1.5.8 Description The plugin fails to verify the status or ownership of a listing before returning its content via a public AJAX action. This allows unauthenticated attackers to access and re...

CVE-2026-88617

SmartAdmin v3.30.0 is affected by an authorization flaw located in the configuration query endpoint . This vulnerability allows a remote attacker to achieve privilege escalation . No specific remediation steps or exploit details are provided in the documents.

PT-2026-92443

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description Buffer overflow issues exist in an API endpoint that could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying operatin...

PT-2026-92094

Name of the Vulnerable Software and Affected Versions vikunja versions prior to 2.6.0 Description Authenticated users can enumerate all teams and members because the software fails to validate team access when attaching teams to projects. By sending arbitrary team IDs to the project teams endpoin...

PT-2026-91864

A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function blacklist of the file core/httpd.py of the component Blacklist Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been...

PT-2026-91935

Name of the Vulnerable Software and Affected Versions pig versions prior to 4.1.0 Description An authentication bypass exists in the '/register/password' endpoint. The system discards the results of the current password verification, which allows any value to be accepted as the current password...

CVE-2026-76706: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could result in the disclosure of security-relevant configuration details and security feature status, whic...

CVE-2026-76701: Missing Authentication for Critical Function

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to netwo...

CVE-2026-76691: Buffer Copy without Checking Size of Input

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-76705: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system...

CVE-2026-76687: Improper Privilege Management

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges o...

CVE-2026-76672: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint...

CVE-2026-88617: Incorrect Authorization

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges...

CVE-2026-91997: Incorrect Comparison

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...

CVE-2026-62280: Improper Neutralization of Input During Web Page Generation

Open Access Management OpenAM is an access management solution. From 13.0.0 until 16.1.2, the OAuth2 authorize endpoint's display=wap consent page reflects request-derived values through ConsentRequiredResource and wap/authorize.ftl without HTML escaping. An attacker can induce a user with an...

CVE-2026-44203: Improper Neutralization of Input During Web Page Generation

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the OAuth 2.0 and OpenID Connect authorization endpoint does not sufficiently encode user-supplied parameters before FormPostResponse.ftl and checkSession.ftl render them into HTML for the formpost response mode. An...

CVE-2026-84048: Improper Access Control

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server...