PT-2026-80964

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the setTime function. The flaw stems from insufficient filtering of the username and password variables before they are used in command...

PT-2026-80977

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description Multiple models contain a flaw in the setDevNet function where insufficient filtering of the username and password fields allows for command injection. A remote attacker with vali...

PT-2026-80959

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the getDetail function. The flaw stems from insufficient filtering of the username and password fields before they are used in command executio...

PT-2026-80962

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the fdftDevice function. The flaw stems from insufficient filtering of the username and password fields before they are used in command...

PT-2026-80963

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the setDevProto function. The flaw stems from insufficient filtering of the username and password variables before they are used in command...

EUVD-2026-64900

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...

PT-2026-80953

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the sysreboot function. The flaw stems from insufficient filtering of the config, act, pathN, and valueN fields before they are used in command...

PT-2026-80970

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A buffer overflow occurs in the sysreboot function due to the unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker with valid administrative...

PT-2026-80946

Name of the Vulnerable Software and Affected Versions DrayTek VigorAP affected versions not specified Description A buffer overflow exists in the apautotest function. The issue stems from missing length checks during memory copy operations involving the CMD6 field. A remote attacker with valid...

PT-2026-80957

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the auth set function. The flaw stems from insufficient filtering of the username and password fields before they are used in command execution...

PT-2026-80944

Name of the Vulnerable Software and Affected Versions DrayTek VigorAP affected versions not specified Description A command injection issue exists in the apautotest function. The flaw stems from insufficient validation of the CMD0, CMD3, and CMD6 fields before they are executed as commands. A...

PT-2026-80950

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the commandTable function. The flaw stems from incomplete filtering of dangerous characters, including backticks, newline characters, and singl...

PT-2026-80940

Name of the Vulnerable Software and Affected Versions DrayTek VigorAP affected versions not specified Description A command injection issue exists in the setLan function. The flaw stems from insufficient validation of the lanIp and lanNetmask variables before they are used in command execution. A...

PT-2026-80941

Name of the Vulnerable Software and Affected Versions DrayTek VigorAP affected versions not specified Description A command injection issue exists in the setcamset function. The flaw stems from insufficient filtering of the selectSlaves field before command execution. A remote attacker with valid...

PT-2026-80951

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch affected versions not specified Description A command injection issue exists in the pingtrace function due to insufficient validation of the host field before command execution. A remote attacker with valid administrative...

PT-2026-80945

Name of the Vulnerable Software and Affected Versions DrayTek VigorAP affected versions not specified Description A buffer overflow exists in the setLan function due to missing length checks during memory copy operations. This issue affects the lanVlanId0, lanIp, and lanNetmask fields. A remote...

PT-2026-79830

A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the...

PT-2026-81034

Name of the Vulnerable Software and Affected Versions OneNav version 1.2.4 Description An authenticated user can perform arbitrary file deletion through the import link function. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerabilit...

PT-2026-81066

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely...

CoreDNS DNS Server Unauthenticated Access

The vulnerability of the longestMatch function in the plugin/transfer/transfer.go file of the CoredNS DNS server is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...