PT-2026-73072

Name of the Vulnerable Software and Affected Versions Evergreen versions prior to 3.14.12 Evergreen versions prior to 3.15.12 Evergreen versions prior to 3.16.6 Evergreen versions prior to 3.17-beta2 Description A remote SQL injection exists within the open-ils.fielder OpenSRF Service, specifical...

PT-2026-73069

Name of the Vulnerable Software and Affected Versions code-projects Online Shopping System version 1.0 Description A remote SQL injection is possible due to improper handling of the total count argument within the '/checkout process.php' endpoint. SQL injection is a technique where an attacker...

PT-2026-73067

Name of the Vulnerable Software and Affected Versions code-projects Online Shopping System version 1.0 Description An issue exists in the /homeaction.php file where improper handling of the cat id parameter allows for remote SQL injection. SQL injection is a technique where an attacker inserts...

PT-2026-73071

A vulnerability was detected in SourceCodester Stock Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=delete supplier. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public an...

PT-2026-73070

Name of the Vulnerable Software and Affected Versions Tenda AC10 version 16.03.10.09 multi TDE01 Description A flaw in the httpd component allows for improper authentication via the R7WebsSecurityHandler function. This issue can be exploited remotely to bypass authentication mechanisms...

PT-2026-73078

A security flaw has been discovered in DefaultFuction Notice-System-Managent 2.0. This issue affects the function GroovyShell.evaluate of the file /execute of the component NoticeController. The manipulation results in code injection. The attack can be launched remotely. The exploit has been...

PT-2026-73101

Name of the Vulnerable Software and Affected Versions DefaultFuction Customer-Relationship-Management-In-C-Project version 2.0 Description A stack-based buffer overflow exists in the Customer Search Module. This issue occurs within the gets function and can be triggered remotely. A stack-based...

PT-2026-73102

Name of the Vulnerable Software and Affected Versions itsourcecode Hospital Management System version 1.0 Description A remote SQL injection is possible due to the improper handling of the delid argument within the /vieworder.php endpoint. SQL injection is a technique where an attacker inserts...

PT-2026-73106

Name of the Vulnerable Software and Affected Versions WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors versions prior to 2.7.1 Description An issue exists where authenticated attackers with shop manager-level access or higher can perform a generic SQL Injection. This...

PT-2026-73175

Name of the Vulnerable Software and Affected Versions Edimax EW-7478APC version 1.04 Description Remote command injection is possible through the manipulation of the rootAPmac argument within the formWlbasic function of the '/goform/formWlbasic' endpoint. Command injection is a flaw that allows a...

PT-2026-73178

A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the argument interface leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...

PT-2026-73075

Name of the Vulnerable Software and Affected Versions OpenBoxes versions prior to 0.9.8-hotfix1 Description An issue exists in the Template Processing component where the buildZebraTemplate function in the grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy file fails to...

PT-2026-73068

Name of the Vulnerable Software and Affected Versions code-projects Online Shopping System version 1.0 Description A security flaw exists in the /checkout.php endpoint. A remote attacker can perform cross site scripting XSS—a technique used to inject malicious scripts into web pages viewed by oth...

PT-2026-73171

A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetch pagination url of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is...

PT-2026-73172

Name of the Vulnerable Software and Affected Versions graphlit graphlit-mcp-server version 1.0.1 Description A server-side request forgery SSRF issue exists in the ssrf-test Endpoint within the fetch function of the src/tools.ts file. This occurs when the url argument is manipulated, allowing a...

PT-2026-73173

Name of the Vulnerable Software and Affected Versions iatsiuk pptr-mcp versions prior to 0.2.8 Description A flaw in the execute Tool component allows for remote code injection. The issue resides within the executeCode function located in the src/vm-executor.ts file. Recommendations At the moment...

PT-2026-73177

A flaw has been found in Edimax EW-7478APC 1.04. Affected by this vulnerability is the function setWAN of the file /goform/setWAN. Executing a manipulation of the argument pppUserName/pptpUserName/L2TPUserName can lead to command injection. The attack may be performed from remote. The exploit has...

Fedora 44 : libgsasl (2026-f2ced62115)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f2ced62115 advisory. Fix for CVE-2026-48829 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

Linux Distros Unpatched Vulnerability : CVE-2026-20786

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds read for the IntelR NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary wi...

SUSE CVE-2026-74485

In the Linux kernel, the following vulnerability has been resolved: binfmtmisc: reject a flag character as the field delimiter The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string createent...