CVE-2026-71287

Cacti CVE-2026-71287 involves a flaw in sanitize_sql_column() in lib/functions.php. The function filters ORDER BY column names with preg_replace('/[^a-zA-Z0-9_().]/', '', $column), which leaves letters, digits, underscore, parentheses, and dot. This allows payloads like SLEEP(5) to pass unmodifie...

CVE-2026-71287 Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to Blind SQL Injection

Cacti's sanitizesqlcolumn lib/functions.php sanitizes user-supplied ORDER BY column names using the regex pregreplace'/^a-zA-Z0-9./', '', $column. Because this allowlist retains letters, digits, underscore, parentheses, and dot intended to support expressions like COUNTid and table.column, a...

MAL-2026-12493 Malicious code in utility-kit-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11d4f4654f1acbc26d30e2ea0cae4816bf6e3a847dce2456134d050a38a8a575 The package's default export getPlugin issues a fetch to the hardcoded bare-IP URL https://31.97.137.157:45000/icons/109 and passes the returned...

Malicious code in utility-kit-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11d4f4654f1acbc26d30e2ea0cae4816bf6e3a847dce2456134d050a38a8a575 The package's default export getPlugin issues a fetch to the hardcoded bare-IP URL https://31.97.137.157:45000/icons/109 and passes the returned...

CVE-2026-71254

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handlereadfilerecord function FC 0x14, Read File Record in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's recordlength is at most 124, but i...

CVE-2026-71232

MacCMS10's admin template editor application/admin/controller/Template.php blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, showsource, createfunction, registershutdownfunction, registertickfunction, and errorlog. Combined...

CVE-2026-6020

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handleaction method passing user-supplied input directly to calluserfunc without an allowlist o...

CVE-2026-17505

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

CVE-2026-17544

A flaw was found in PHP. A remote attacker could exploit this vulnerability by providing specially crafted inputs to the bccomp function. This could lead to an out-of-bounds write, resulting in stack and heap corruption. Such memory corruption can enable arbitrary code execution, allowing the...

EUVD-2026-53284

The ShopLentor plugin for WordPress is vulnerable to arbitrary function execution via the woolentoropt/v1/custom-action REST API endpoint in all versions up to, and including, 3.3.7. This is due to the handleaction method passing user-supplied input directly to calluserfunc without an allowlist o...

EUVD-2026-53199

The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height. When an offset exceeds the corresponding source dimension, width2 - offsetx or the height...

CVE-2026-71202 raster: Integer Underflow in crop() Offset Handling Causes Capacity-Overflow Panic

The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height. When an offset exceeds the corresponding source dimension, width2 - offsetx or the height...

CVE-2026-18902

A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit i...

CVE-2026-18898

A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. This affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to...

CVE-2026-18898 UTT HiPER 1200GW ConfigAdvideo strcpy stack-based overflow

A security flaw has been discovered in UTT HiPER 1200GW up to v2.5.3-170306. This affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the argument timestart results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to...

CVE-2026-18895

A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-18895

CVE-2026-18895 affects UTT HiPER 1250GW builds

CVE-2026-52466

Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to t...

CVE-2026-52466

Summary: CVE-2026-52466 affects Open Library Foundation VuFind v11.0.3 and v4.1. The issue arises in VuFind\Controller\AbstractBase::validateAccessPermission, where controller-level access checks fail to prevent execution of the target function after access is denied. As a result, the requested f...

CVE-2026-52466

Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to t...