CVE-2026-18995

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out...

CVE-2026-18995 netease-youdao LobsterAI MEDIA Path artifactParser.ts parseMediaTokensFromText information disclosure

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out...

CVE-2026-18976

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function gettooldefinitions of the file agent/agentinit.py of the component disabledtoolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The explo...

CVE-2026-18976

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function gettooldefinitions of the file agent/agentinit.py of the component disabledtoolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The explo...

PT-2026-68485

A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function ssh exec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The...

CVE-2026-48079: Insufficient Session Expiration

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

PT-2026-68809

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description A stored cross-site scripting issue exists in the crawler domain view. The application embeds crawled URLs directly into a JavaScript onclick handler used to display stored screenshots...

CVE-2026-18995: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out...

PT-2026-68378

Name of the Vulnerable Software and Affected Versions netease-youdao LobsterAI version 2026.6.10 Description A flaw in the MEDIA Path Handler component allows for remote information disclosure. The issue resides within the parseMediaTokensFromText function located in the...

PT-2026-68668

Name of the Vulnerable Software and Affected Versions Insta InstaKNXServiceApp version 1.2.3.1469 Description A flaw in the Firmware Update Handler component allows remote attackers to perform a manipulation that leads to insufficient verification of data authenticity via the...

PT-2026-68416

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Broadcom BDC UDC driver contains a race condition during the removal process. The driver uses devm request irq in the bdc udc init function, which means the interrupt request IRQ is...

Linux Distros Unpatched Vulnerability : CVE-2026-64603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit...

CVE-2026-64587

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: arc: emac: quiesce interrupts before requesting IRQ Normal RX/TX interrupts are enabled later, in arcemacopen, so probe should not see interrupt delivery in the usual case. However, hardware may still present stale...

PT-2026-68748

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description A privilege escalation exists where a user with TENANT ADMIN permissions can promote themselves or another collaborator to a platform-wide GLOBAL ADMIN via a single PUT request. The role-update...

PT-2026-68739

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.1.0 Description The GET handler at the endpoint /api/tenants/id/appointments/appointmentId fails to perform authorization checks. This allows any party with a valid appointment UUID to retrieve the full...

CVE-2026-19061: Insufficient Verification of Data Authenticity

A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndDownloadFileList of the component Firmware Update Handler. Executing a manipulation can lead to insufficient verification of data authenticity. It is possible to launch the attac...

CVE-2026-71446: Improper Neutralization of Input During Web Page Generation

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

CVE-2026-19039: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function sshexec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The...

PT-2026-68679

Name of the Vulnerable Software and Affected Versions DataGear versions prior to 5.0.0 Description Cross site scripting occurs in the Chart Name Handler component due to improper handling of the Title argument within the HtmlTplDashboardWidgetHtmlRenderer function of the...

EulerOS 2.0 SP15 : curl (EulerOS-SA-2026-2879)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability, which was classified as problematic, has been found in cURL up to 8.19.0 Network Utility Software. Affected by this issue is some...