PT-2026-21515

An information exposure vulnerability exists in Vulnerability in HCL Software ZIE for Web. The application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the...

PT-2026-21550

Name of the Vulnerable Software and Affected Versions Traccar versions up to and including 6.11.1 Description The Traccar GPS tracking system is susceptible to a Cross-Site WebSocket Hijacking CSWSH issue. The application does not properly validate the Origin header during the WebSocket handshake...

CVE-2025-71056

Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user...

CVE-2025-71056

Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user...

PT-2026-21553

Name of the Vulnerable Software and Affected Versions GCOM EPON 1GE ONU version C00R371V00B01 Description The software suffers from improper session management, which enables attackers to hijack user sessions. This is achieved by spoofing the IP address of an authenticated user. Recommendations...

PT-2026-21496

Name of the Vulnerable Software and Affected Versions eAI Technologies ERP F2 affected versions not specified Description The software contains a DLL Hijacking vulnerability. This issue allows authenticated local attackers to place a crafted DLL file in the same directory as the program to execut...

GCOM EPON 1GE 安全漏洞

GCOM EPON 1GE is a fiber-optic access device developed by GCOM Corporation. The GCOM EPON 1GE ONU C00R371V00B01 version contains a security vulnerability. This vulnerability stems from improper session management, and it could allow attackers to carry out session hijacking attacks by manipulating...

Traccar 安全漏洞

Traccar is a Java-based website monitoring system developed by the American company Traccar. This software supports over 170 GPS protocols and over 1,500 types of GPS tracking devices. Traccar can be used alongside any major SQL database systems. It also provides a user-friendly REST API. Traccar...

PT-2026-21569

Name of the Vulnerable Software and Affected Versions Bludit version 3.16.2 Description The application does not properly sanitize content input on the server side, despite client-side sanitation. An authenticated user can inject JavaScript into the post content field. This injected script execut...

CVE-2025-71056

CVE-2025-71056 affects GCOM EPON 1GE ONU, version C00R371V00B01. The root cause is improper session management that enables session hijacking by spoofing the IP address of an authenticated user. Reported impact is high for confidentiality and integrity (per CVSS 3.1). Public references consistent...

eAI ERP 代码问题漏洞

eAI ERP is an enterprise resource management software developed by eAI Corporation. eAI ERP has code vulnerabilities, which stem from DLL hijacking. These vulnerabilities may allow authenticated local attackers to execute arbitrary code...

HCL Software ZIE for Web 安全漏洞

HCL Software ZIE for Web is a terminal emulation software developed by the Indian company HCL. Version HCL Software ZIE for Web v16 contains a security vulnerability. This vulnerability stems from the application transmitting sensitive session tokens and authentication identifiers through URL que...

GO-2026-4394 OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking in go.opentelemetry.io/otel/sdk...

CVE-2025-40697

CVE-2025-40697 describes a Reflected XSS in Lewe WebMeasure affecting the endpoint /index.php via the page parameter. The vulnerability could allow an attacker to execute arbitrary code in the context of a user session, with potential data exposure such as session cookies and the ability to perfo...

CVE-2025-27901

IBM DB2 Recovery Expert for LUW 5.5 Interim Fix 002 IBM Db2 Recovery Expert for Linux, UNIX and Windows is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system,...

PT-2026-20924

Splunk Enterprise Windows flaws CVSS 7.7 CVE-2026-20143 & CVE-2026-20140 allow system takeover via DLL and Python search path hijacking. Patch immediately. Splunk CyberSecurity InfoSec WindowsSecurity DLLHijacking LPE PatchNow https://t.co/wudRkJ9tIM...

PT-2026-20923

Name of the Vulnerable Software and Affected Versions Splunk Enterprise for Windows versions prior to 10.2.0 Splunk Enterprise for Windows versions prior to 10.0.3 Splunk Enterprise for Windows versions prior to 9.4.8 Splunk Enterprise for Windows versions prior to 9.3.9 Splunk Enterprise for...

Splunk Enterprise 9.2.0 < 9.2.12, 9.3.0 < 9.3.9, 9.4.0 < 9.4.8, 10.0.0 < 10.0.3 (SVD-2026-0205)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2026-0205 advisory. - In Splunk Enterprise for Windows versions below 10.2.0, 10.0.3, 9.4.8, 9.3.9, and 9.2.12, a lowprivileged Windows user who ca...

CVE-2026-26281

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting XSS vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser o...

CVE-2026-26281 InvoicePlane has Stored Cross-Site Scripting (XSS) Issue in Sumex Invoice View

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A stored cross-site scripting XSS vulnerability in the Sumex invoice view allows an authenticated user with client and invoice management privileges to execute arbitrary JavaScript in the browser o...