CVE-2026-13518

CVE-2026-13518 affects Tenda JD12L firmware 16.03.53.23. The vulnerability targets the function fromAddressNat in the file /goform/addressNat, where manipulation of the argument page causes a stack-based buffer overflow. Remote exploitation is possible, and the exploit has been disclosed publicly...

CVE-2026-13517

The CVE-2026-13517 entry describes a stack-based overflow in Tenda JD12L’s /goform/WifiBasicSet function (parameter security_5g) impacting firmware 16.03.53.23. The root cause is a stack-based buffer overflow caused by manipulation of security_5g, allowing remote execution. Exploitation is report...

PT-2026-53207

A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request forgery. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2026-51218

A heap buffer overflow in the TS7Worker::PerformFunctionWrite function /core/s7server.cpp of snap7 v1.4.3 allows attackers to cause a Denial of Service DoS via a crafted packet...

PT-2026-53358

An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string...

CVE-2026-51218

A heap buffer overflow in the TS7Worker::PerformFunctionWrite function /core/s7server.cpp of snap7 v1.4.3 allows attackers to cause a Denial of Service DoS via a crafted packet...

PT-2026-53276

A flaw has been found in SourceCodester Simple Food Ordering System 1.0. The affected element is an unknown function of the file /cart.php. Executing a manipulation of the argument item price can lead to business logic errors. The attack may be performed from remote. The exploit has been publishe...

PT-2026-53402

URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http endpoints/http system.py" is subsequently passed to the "os.system" function in "cbpi/controller/system controller.py" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi ...

PT-2026-53751

Name of the Vulnerable Software and Affected Versions snap7 version 1.4.3 Description A heap buffer overflow occurs in the TS7Worker::PerformFunctionWrite function located in /core/s7 server.cpp. This issue allows an attacker to trigger a Denial of Service DoS by sending a specially crafted packe...

PT-2026-53750

Name of the Vulnerable Software and Affected Versions EIPStackGroup OpENer commit 76b95c Description A buffer overflow occurs in the Get Attribute List function when processing a specially crafted Common Packet Format CPF packet, which is a standardized data structure used for communication. This...

PT-2026-53231

A security flaw has been discovered in CodeAstro Complaint Management System 1.0. The affected element is the function deletereport of the file application/controllers/Report.php of the component Report Endpoint. The manipulation results in authorization bypass. The attack can be executed remotel...

PT-2026-53525

In PaddlePaddle before 2.4, paddle.audio.functional.get window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead to arbitrary code execution...

PT-2026-53633

In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger code execution on the Vitrage service host as the user the Vitrage service runs under. This may result in unauthorized access to the host and further compromise...

CVE-2026-51218

A heap buffer overflow in the TS7Worker::PerformFunctionWrite function /core/s7server.cpp of snap7 v1.4.3 allows attackers to cause a Denial of Service DoS via a crafted packet...

PT-2026-53528

An issue in pandas-ai v.0.8.1 and before allows a remote attacker to execute arbitrary code via the is jailbreak function...

Microsoft 365 Copilot Auth Bypass Info Disclosure

The vulnerability of Microsoft 365 Copilot’s intelligent virtual assistant is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow a malicious actor to disclose confidential information remotely...

CVE-2026-13509 RAGapp Knowledge File files.py FileHandler.remove_file path traversal

A vulnerability has been found in RAGapp up to 0.1.5. Affected is the function FileHandler.uploadfile/FileHandler.removefile of the file src/ragapp/backend/controllers/files.py of the component Knowledge File Handler. Such manipulation leads to path traversal. The attack can be executed remotely...

CVE-2026-13507

A vulnerability was detected in volcengine OpenViking up to 0.3.21. This affects the function strtouint64 of the file openviking/storage/vectordb/utils/strtouint64.py of the component Local VectorDB Primary-key Label Handler. The manipulation of the argument ID results in insufficient verificatio...

UBUNTU-CVE-2026-13500

A weakness has been identified in antlr ANTLR4 up to 4.13.2. Affected is an unknown function of the file tool/src/org/antlr/v4/codegen/model/OutputFile.java of the component Grammar Action Block Handler. Executing a manipulation can lead to code injection. The attack may be launched remotely. The...

CVE-2026-13498

The CVE concerns yashpokharna2555 restaurant-management-system. It identifies a vulnerability in an unknown function within /forgotpassword.php (POST Parameter Handler) where manipulating the email parameter leads to SQL injection. The issue can be exploited remotely and publicly available exploi...