CVE-2026-11851

Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation Refer to the ' ...

PT-2026-60311

Name of the Vulnerable Software and Affected Versions xszyou Fay version 4.3.1 Description Remote code execution is possible via the MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface to configure an MCP STDIO...

PT-2026-60231

Pegatron Tdelo64.sys improperly exposes privileged hardware access functionality through the .TdeIo device interface. IOCTL handlers including TDE IOCTL INDEXIO READ and TDE IOCTL INDEXIO WRITE permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without...

PT-2026-60358

A MantisBT user having $g update bug threshold UPDATER by default can change an Issue's Status via REST and SOAP API, even if the $g set status threshold config is set to a higher level DEVELOPER by default. Impact Unauthorized change in Issue workflow. Patches...

PT-2026-58873

Name of the Vulnerable Software and Affected Versions ASUS System Control Interface versions 3.0.x ASUS Business Manager affected versions not specified Description The ASUS System Control Interface driver and ASUS Business Manager contain issues related to resource allocation without limits and...

PT-2026-60217

Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

CVE-2026-30618

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulti...

PT-2026-60357

MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin "Manage Configuration" feature adm config set.php. When setting a configuration value with a non-string type integer, float, complex, the value is passed through ConfigParser - Tokenizer, which calls eval with...

PT-2026-60284

Our latest Scorpion Labs blog dives into the research behind CVE-2026-20374, covering UART access, Ghidra, remote debugging, ROP chains, and embedded exploit development. Read the full blog: https://t.co/6bUfLFjkfC https://t.co/9lHSOGJjJY...

Siemens SICAM 8 product authorization issue and vulnerabilities

The Siemens CPCI85 Central Processing/Communication is a central processing and communication device developed by the German company Siemens. The Siemens SICORE Base system is a core foundational software component of the SICAM 8 power automation platform, designed specifically for substation...

PT-2026-60356

MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mci check login function. Any user knowing any valid cookie string can authenticate as any other user knowing their username, including the administrator, without knowing the target's password. The vulnerabili...

How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement

As AI agents gain prevalance, users are increasingly exposed to the risks such systems entail. Prompt injection attacks, as well as hallucination, can cause agents to leak private information to third parties. As autonomous systems, agents also present the more active danger of performing sensiti...

PT-2026-58875

Name of the Vulnerable Software and Affected Versions ASUS System Control Interface v3 affected versions not specified ASUS System Control Interface affected versions not specified ASUS Business Manager affected versions not specified Description An out-of-bounds read exists in the software that...

CVE-2026-30618

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulti...

PT-2026-60246

Dell ThinOS 10, versions prior to 2605 10.2100, contain an Obsolete Feature in UI vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-30618

xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulti...

PT-2026-60390

Name of the Vulnerable Software and Affected Versions MCP Documentation Server version 1.13.0 Description The Web UI and document-management API bind to all network interfaces by default instead of localhost, and the API does not require authentication. This allows a network-reachable client on t...

PT-2026-58893

Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.14.1 Description An issue exists in the Report Execution API 'runreports' endpoint where report parameter values are incorporated into the generated SQL query without sufficient validation. This allows an...

ROS-20260715-73-0012

The vulnerability of Google Chrome’s user interface is related to errors in how information is presented on the user interface. Exploiting this vulnerability can allow a remote attacker to execute a spear-phishing attack...

PT-2026-58874

Name of the Vulnerable Software and Affected Versions ASUS System Control Interface v3 affected versions not specified ASUS System Control Interface affected versions not specified ASUS Business Manager affected versions not specified Description An untrusted pointer dereference exists in the...