CVE-2025-70796

An unauthenticated path traversal vulnerability exists in the web management interface of WTI Wireless Technology, Inc. version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web roo...

EulerOS 2.0 SP12 : golang (EulerOS-SA-2026-2591)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv...

The vulnerability in the web interface of the operating system PAN-OS allows a hacker to bypass existing security mechanisms.

The vulnerability of the PAN-OS operating system’s web management interface is related to insufficient checking of requests on the server side. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms remotely...

The vulnerability in the web interface of the operating system PAN-OS, which allows a perpetrator to disclose protected information

The vulnerability of the PAN-OS operating system’s web management interface is related to the disclosure of information through caching. Exploiting this vulnerability can allow a remote attacker to disclose the protected information...

CVE-2026-51119

An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components...

PT-2026-57233

An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components...

CVE-2026-15374: Improper Authorization

A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/roleAddAction.do of the component Group Interface. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been...

PT-2026-57058

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control...

PT-2026-57227

An unauthenticated path traversal vulnerability exists in the web management interface of WTI Wireless Technology, Inc. version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web roo...

PT-2026-57203

A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/roleAddAction.do of the component Group Interface. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been...

The vulnerability in the web interface of the operating system PAN-OS allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the PAN-OS operating system’s web management interface is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality and integrity of the protected information...

PT-2026-57150

The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access...

PT-2026-57204

A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/users ldap.jsp of the component LDAP User Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2026-54771: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.3, a Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with use=False, handle=True. Version...

CVE-2026-15375: Improper Authorization

A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/usersldap.jsp of the component LDAP User Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed ...

PT-2026-57164

Name of the Vulnerable Software and Affected Versions Lucee CFML Server versions 5.3.x Lucee CFML Server versions 6.1.x Lucee CFML Server versions 6.2.x Lucee CFML Server versions 7.0.x Description Reflected cross-site scripting occurs during URL path parsing, allowing unauthenticated remote...

CVE-2025-70796

An unauthenticated path traversal vulnerability exists in the web management interface of WTI Wireless Technology, Inc. version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web roo...

The vulnerability of the command-line interface of the PAN-OS operating system, allowing a perpetrator to execute arbitrary commands

The vulnerability of the command-line interface of the PAN-OS operating system is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the Open WebUI web interface, related to deficiencies in the authentication process, allows attackers to escalate their privileges.

The vulnerability of the Open WebUI web interface is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

CVE-2026-54771

Langroid prior to 0.65.3 is affected. A Langroid application exposing a chat interface to untrusted users may allow direct tool invocation via raw JSON payloads, even when tools are registered with use=False, handle=True. Root cause: the tool dispatch path in agent_response → handle_message → get...