CVE-2026-79315

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the...

CVE-2026-76710: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...

CVE-2026-88020: Improper Neutralization of Input During Web Page Generation

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

PT-2026-96799

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.2 SLC9000 versions prior to 9.7.0.2 EMG8500 versions prior to 9.7.0.1 EMG7500 versions prior to 9.7.0.1 SLB882 affected versions not specified SLCx-03 affected versions not specified SLCx-02 affected versions no...

CVE-2026-25254: Improper Authorization

Improper authorization leads to Remote Code Execution via SocketIO interface...

PT-2026-96807

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.3 SLC9000 versions prior to 9.7.0.2 EMG8500/EMG7500 versions prior to 9.7.0.1 SLB882 affected versions not specified SLCx-03 affected versions not specified SLCx-02 affected versions not specified Description...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2 because the full user object is stored in a client-side signed cookie . The application's authentication mechanism only verifies that a user object can be retrieved from the cookie without re-validating against the database or checking a session ve...

PT-2026-96241

Name of the Vulnerable Software and Affected Versions x-ui version 0.3.2 Description A session invalidation flaw occurs because the full user object is stored in a client-side signed cookie. The authentication process only verifies that a user object can be retrieved from the cookie, failing to...

PT-2026-96152

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260717 Description An authentication bypass exists in the web-based network traffic monitoring application where the endpoint "/lua/rest/v2/edit/system/edit blacklist.lua" fails to verify administrator privileges...

PT-2026-96260

Name of the Vulnerable Software and Affected Versions x-ui version 0.3.2 Description An improper access control issue allows any authenticated panel user to modify the xray configuration template via the settings interface. By triggering a panel restart, the xray management gRPC service Google...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

The vulnerability of the command-line interface of the vm2 package manager NPM allows a hacker to execute arbitrary code.

The vulnerability of the command-line interface of the NPM package manager’s vm2 library is related to initialization errors. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

CVE-2026-94145: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-73546: Improper Neutralization of Input During Web Page Generation

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's /stats?format=html admin endpoint uses StatsHtmlRender, which sanitizes string statistic values but emits statistic names without HTML encoding. A data-plan...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-79317: Insufficient Session Expiration

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-79316: Improper Access Control

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and...

ALSA-2026:69112 Important: perl-DBI:1.641 security update

The perl-DBI package provides the standard database interface module for the Perl programming language. It implements a database-independent interface, meaning it defines a consistent set of methods, variables, and conventions for database operations. Security Fixes: perl-DBI: DBI for Perl: Heap...

CVE-2026-94050 D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...