CVE-2026-79569

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

PT-2026-87179

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...

PT-2026-87135

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url references to exfiltrate CSRF toke...

PT-2026-87127

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to inject Yii2 behavior attachments and event handlers. Attackers can post field-layout tab elements as JSON strings to bypass cleanse validation, then trigger...

PT-2026-87003

A vulnerability has been identified in Teamcenter V2412 All versions V2412.0013, Teamcenter V2506 All versions V2506.0010, Teamcenter V2512 All versions V2512.2607, Teamcenter V2606 All versions V2606.2607. Affected applications do not properly encode user-supplied input reflected into HTML...

EUVD-2026-72775

A reflected cross-site scripting XSS vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filterfilters0field parameter...

PT-2026-87215

Improper neutralization of special elements in output used by a downstream component 'injection' in SQL Server allows an unauthorized attacker to elevate privileges over a network...

PT-2026-87222

Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...

PT-2026-87027

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

PT-2026-88179

🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — September 9, 2026 1️⃣ CPANEL EMAILTRACK SQL INJECTION LEADS TO ROOT A critical flaw in cPanel CVE-2026-67401 turns the EmailTrack feature into a full remote-code-execution path: a regular authenticated cPanel account with mail privileges can abuse...

PT-2026-88176

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or...

Fedora 43 : emacs (2026-6b1a89dfe6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6b1a89dfe6 advisory. Fix CVE-2026-79992: Local shell command injection through the user field in emacs tramp Tenable has extracted the preceding description block directly from t...

EulerOS 2.0 SP12 : libinput (EulerOS-SA-2026-3351)

According to the versions of the libinput packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary...

Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code...

NewStart CGSL MAIN 7.02 : cups-filters Vulnerability (NS-SA-2026-0089)

The remote NewStart CGSL host, running version MAIN 7.02, has cups-filters packages installed that are affected by a vulnerability: - libppd = 2.1b1 ppdCreatePPDFromIPP2 does not validate or sanitize the IPP attributes when writing them to a temporary PPD file, allowing the injection of attacker...

PT-2026-87038

SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code execution in the Node-enabled desktop renderer. Attackers can craft malicious web pages that write to the clipboard, and when pasted into SiYuan, injected...

NewStart CGSL MAIN 7.02 : ruby Multiple Vulnerabilities (NS-SA-2026-0108)

The remote NewStart CGSL host, running version MAIN 7.02, has ruby packages installed that are affected by multiple vulnerabilities: - Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands...

EulerOS 2.0 SP12 : proftpd (EulerOS-SA-2026-3298)

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the...

CVE-2026-82756

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-82584

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...