CVE-2026-33940 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, a crafted object placed in the template context can bypass all conditional guards in resolvePartial and cause invokePartial to return undefined. The Handlebars runtime then treats the...

CVE-2026-27857

The CVE-2026-27857 issue affects the Dovecot IMAP server where sending a NOOP with 4000+ parentheses causes about 1 MB of memory to be allocated for each connection. Attackers could spawn many connections (potentially from a single IP) to exhaust VSZ and disrupt the service or other proxied conne...

PT-2026-28647

Name of the Vulnerable Software and Affected Versions NEC Platforms, Ltd. Aterm Series affected versions not specified Description A hidden functionality exists in NEC Platforms, Ltd. Aterm Series that allows an attacker to enable telnet access via the network. Recommendations At the moment, ther...

PT-2026-28477

Name of the Vulnerable Software and Affected Versions BUFFALO Wi-Fi router products affected versions not specified Description A missing authentication check for a critical function allows an attacker to forcibly reboot the product without authentication. There is no information about the number...

PT-2026-28475

Name of the Vulnerable Software and Affected Versions BUFFALO Wi-Fi router products affected versions not specified Description A hidden functionality issue exists that may allow an attacker to gain access to the product’s debugging functionality. Successful exploitation could result in the...

CVE-2026-33638

CVE-2026-33638 (Ech0) : Prior to version 4.2.0, the public endpoint GET /api/allusers exposes user records without authentication, enabling remote unauthenticated user enumeration and exposure of user profile metadata. The issue is in the internal/router handling of /api/allusers. A fix is availa...

PT-2026-28296

Name of the Vulnerable Software and Affected Versions HCL Aftermarket DPC affected versions not specified Description HCL Aftermarket DPC is susceptible to an HTTP Response Splitting issue. The impact of this issue depends on how the web application processes split responses, potentially allowing...

PT-2026-28663

Name of the Vulnerable Software and Affected Versions code-projects Online Food Ordering System version 1.0 Description A security issue exists in code-projects Online Food Ordering System 1.0, specifically within an unknown functionality of the /dbfood/food.php file. Manipulation of the cuisines...

📄 node-tesseract-ocr 2.2.1 Command Injection

node-tesseract-ocr through version 2.2.1 allows OS command injection in recognize in src/index.js. The package builds a shell command string and executes it with childprocess.exec. Because the input path is only wrapped in double quotes, an attacker can inject shell syntax through a crafted file...

PT-2026-28286

Name of the Vulnerable Software and Affected Versions HCL Aftermarket DPC affected versions not specified Description The application suffers from missing functional level access control, potentially allowing an attacker to escalate privileges and compromise the application. This could lead to th...

PT-2026-28393

Name of the Vulnerable Software and Affected Versions ZerBea hcxpcapngtool version 7.0.1-43-g2ee308e Description A buffer overflow condition exists in ZerBea hcxpcapngtool. A local attacker can potentially obtain sensitive information by exploiting the getradiotapfield function. Recommendations A...

CVE-2026-33218

CVE-2026-33218 affects NATS-Server. Prior to versions 2.11.15 and 2.12.6, a client able to reach the leafnode port can crash the server with a specially malformed message before authentication. Versions 2.11.15 and 2.12.6 include a fix. Affected product: NATS-Server (leafnode handling). Root caus...

CVE-2026-27889

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Starting in version 2.2.0 and prior to versions 2.11.14 and 2.12.5, a missing sanity check on a WebSockets frame could trigger a server panic in the nats-server. This happens before authentication, and...

PT-2026-25937

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description A specially crafted aggregation query utilizing the $lookup operator, submitted by an authenticated user possessing write privileges, can lead to a double-free or use-after-free memory issue...

PT-2026-25906

Name of the Vulnerable Software and Affected Versions versions prior to 2026-4147 Description An authenticated user with the read role may read limited amounts of uninitialized stack memory via specially-crafted issuances of the filemd5 command. This can occur through invocations of the filemd5...

Security Bulletin: IBM App Connect Enterprise is vulnerable to denial of service due to Node.js module axios (CVE-2026-25639)

Summary IBM App Connect Enterprise runtime and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to denial of service due to Node.js module axios. Vulnerability Details CVEID:CVE-2026-25639 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.j...

CVE-2026-34353 affecting package ocaml for versions less than 4.13.1-3

CVE-2026-34353 affecting package ocaml for versions less than 4.13.1-3. An upgraded version of the package is available that resolves this issue...

CVE-2025-39813 affecting package kernel for versions less than 5.15.200.1-1

CVE-2025-39813 affecting package kernel for versions less than 5.15.200.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-27146 GetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary Uploads

GetSimple CMS is a content management system. All versions of GetSimple CMS do not implement CSRF protection on the administrative file upload endpoint. As a result, an attacker can craft a malicious web page that silently triggers a file upload request from an authenticated victim’s browser. The...

PT-2026-20404

Name of the Vulnerable Software and Affected Versions NVIDIA NeMo Framework affected versions not specified Description The NVIDIA NeMo Framework contains a flaw that could allow for remote code execution. Exploitation of this issue may result in code execution, escalation of privileges,...