PT-2026-56411

Name of the Vulnerable Software and Affected Versions Mediküm Web versions through 08072026 Description Improper neutralization of input during web page generation allows Reflected Cross-Site Scripting XSS, a flaw where malicious scripts are reflected off a web application to the victim's browser...

PT-2026-56615

Name of the Vulnerable Software and Affected Versions GitLab EE versions 13.11 through 18.11.6 GitLab EE versions 19.0 through 19.0.3 GitLab EE versions 19.1 through 19.1.1 Description An issue exists where improper sanitization of user-supplied input could allow an authenticated user with...

PT-2026-56634

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.115 Description Insufficient validation of untrusted input in WebAppInstalls allows a local attacker to bypass the same origin policy via a crafted HTML page. The same origin policy is a...

Poly Voice – Potential Unauthorized Modification of WebUI using XSS Attack

The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage. HP has released updates to mitigate the potential vulnerabilities. HP has identified affected products with minimum versions that mitigate the potential vulnerabilities. See...

PT-2026-56662

Name of the Vulnerable Software and Affected Versions Drupal Siteimprove Analytics versions 0.0.0 through 2.0.1 Description Improper neutralization of input during web page generation allows Cross-Site Scripting XSS. The module fails to sufficiently sanitize the Siteimprove Analytics identificati...

Juniper Junos OS Vulnerability (JSA110079)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA110079 advisory. - An Improper Validation of Specified Quantity in Input vulnerability in the Packet Forwarding Engine pfe of Juniper Networks Junos OS on MX Series allows an unauthenticate...

TP-Link Archer AX20 has a vulnerability related to input validation errors

The TP-Link Archer AX20 is a dual-band wireless router produced by the Chinese company TP-Link. The TP-Link Archer AX20 has a vulnerability related to input validation. This vulnerability stems from improper validation of URLs provided by users via the web interface. Attackers can exploit this...

The vulnerability of the socket.io parser library’s encoder and decoder allows a attacker to induce a service failure.

The vulnerability of the socket.io parser library’s encoder and decoder is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures using a specially created socket.io package...

CVE-2026-24698

An OS command injection vulnerability exists in the savesyslogtofile function of the "httpd" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The modelname configuration parameter is not properly sanitized, which could allow an authenticated...

PT-2026-56661

Name of the Vulnerable Software and Affected Versions Location Selector versions 0.0.0 through 1.3.0 Description An SQL injection issue exists in the Location Selector module, which provides a Views filter for selecting location values. A specific Views filter fails to sufficiently sanitize value...

BeyondTrust Privileged Remote Access (PRA) < 25.3.3 Multiple Vulnerabilities (BT26-03)

The version of BeyondTrust Privileged Remote Access PRA running on the remote host is prior to 25.3.3. It is, therefore, affected by multiple vulnerabilities: - A critical pre-authentication vulnerability in the authentication subsystem. Improper validation of authentication data may allow a...

The vulnerability of the merge_handshake_packet() function in the GnuTLS cryptographic library allows a attacker to trigger a denial-of-service attack.

The vulnerability of the mergehandshakepacket function in the GnuTLS cryptographic library is related to errors in processing parameter values related to input data length. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the __io_openat_prep() function in the io_uring/openclose.c module, an interface for asynchronous input/output in the Linux kernel, allows a attacker to cause a service failure.

The vulnerability of the ioopenatprep function in the iouring/openclose.c module, a component of the Linux kernel’s asynchronous input/output interface, relates to the failure to release resources after their useful period has ended. Exploiting this vulnerability could allow an attacker to cause...

PT-2026-56408

Name of the Vulnerable Software and Affected Versions VikBooking Hotel Booking Engine & PMS versions prior to 1.8.9 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious scripts are...

PT-2026-56484

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.28 Description A credential exposure issue exists where workspace dotenv files can override provider credentials. This allows attackers with lower-trust access to configured input paths to expose sensitive dat...

The vulnerability of the lib/parse.js component in the Node QS string analysis and transformation library allows a attacker to cause a service failure.

The vulnerability of the lib/parse.js component, a library for analyzing and transforming string queries in Node QS, is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures...

PT-2026-56412

Name of the Vulnerable Software and Affected Versions Mediküm Web versions through 08072026 Description Improper neutralization of input during web page generation allows for Stored Cross-Site Scripting XSS, a condition where malicious scripts are permanently stored on the target server and serve...

PT-2026-56400

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.4.1 Description Improper input validation in the Stripe Connect payment processor allows unauthenticated attackers to pay an arbitrary amount. This occurs...

Location Selector - Critical - SQL Injection - SA-CONTRIB-2026-072

The Location Selector module provides a Views filter for selecting location values. One of the provided Views filters does not sufficiently sanitize values that may come from user input, resulting in a SQL injection vulnerability. This vulnerability is mitigated by the fact that a View must exist...

PT-2026-56539

Name of the Vulnerable Software and Affected Versions PasswordPusher versions prior to 2.8.1 Description Insufficient validation in the valid url function allows the application to accept data URI schemes in URL push payloads. This enables attackers to create malicious pushes containing...