PT-2026-78265

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=save menu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-78260

A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been mad...

PT-2026-78266

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been mad...

PT-2026-78719

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be...

UBUNTU-CVE-2026-74955

Privilege escalation in the Request Handling component. This vulnerabi...

ROS-20260819-73-0052

The vulnerability in Tomcat11 is related to the implementation of incorrect control flow. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...

ROS-20260819-73-0047

The vulnerability in Tomcat relates to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2026-50719

Ingenic T41/T32/T40/A1 SoC boot ROMs execute an attacker-controlled init table from the SPL header before secure boot verification, using 32-bit writes to disable SRAM-resident secure boot state, allowing unsigned boot code. Hardware-validated on T41; ROM analysis confirms behavior on other chips...

CVE-2026-75976

TRENDnet TEW-823DRU router firmware 1.1.02b01 contains a stack-based buffer overflow in the strcpy call within /cgi-bin/wan.cgi (NVRAM component), triggered by the wan_l2tp_password argument. CVSS 9.9 (CRITICAL) reflects remote, unauthenticated-exploitable complete confidentiality/integrity/avail...

CVE-2026-61317

creationtimestamp| type| source ---|---|--- 2026-08-18 22:14:25+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfai2f53p2p 2026-08-19 02:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtfpd3fsh22p 2026-08-19 17:51:48+00:00| seen|...

CVE-2026-61258

creationtimestamp| type| source ---|---|--- 2026-08-18 22:14:08+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfahkjrjh2m 2026-08-19 02:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtfor7lsk22m 2026-08-19 17:15:58+00:00| seen|...

CVE-2026-53958 4gaBoards: SSO Pre-Account Takeover / Hijacking via Mass Assignment

4gaBoards is a boards system for realtime project management. Prior to 3.3.9, 4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH /api/users/:id...

CVE-2026-52873

In Streambert 2.5.0–2.6.0, the wyzie-open-redeem IPC handler in index.js strips CSP headers from all responses in the partition:wyzie-redeem session and omits setWindowOpenHandler, allowing injected scripts in sub.wyzie.io or navigated pages to run unconstrained, invoke renderer-exposed functions...

CVE-2026-73921

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. The supported version that is affected is 1.4.20. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this...

CVE-2026-73917

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this...

CVE-2026-73901

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. The supported version that is affected is 4.5.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this...

CVE-2026-73878

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this...

CVE-2026-73876

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. The supported version that is affected is 4.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in...

CVE-2026-73867

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this...

CVE-2026-71165

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Helidon. Successful attacks of this...