78334 matches found
PT-2026-60217
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Reflected Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...
CVE-2026-30618
xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulti...
PT-2026-60357
MantisBT 2.28.3 and earlier contains a remote code execution vulnerability in the admin "Manage Configuration" feature adm config set.php. When setting a configuration value with a non-string type integer, float, complex, the value is passed through ConfigParser - Tokenizer, which calls eval with...
PT-2026-60284
Our latest Scorpion Labs blog dives into the research behind CVE-2026-20374, covering UART access, Ghidra, remote debugging, ROP chains, and embedded exploit development. Read the full blog: https://t.co/6bUfLFjkfC https://t.co/9lHSOGJjJY...
Siemens SICAM 8 product authorization issue and vulnerabilities
The Siemens CPCI85 Central Processing/Communication is a central processing and communication device developed by the German company Siemens. The Siemens SICORE Base system is a core foundational software component of the SICAM 8 power automation platform, designed specifically for substation...
PT-2026-60356
MantisBT 2.28.3 and earlier contains a critical authentication bypass in the SOAP API's mci check login function. Any user knowing any valid cookie string can authenticate as any other user knowing their username, including the administrator, without knowing the target's password. The vulnerabili...
How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement
As AI agents gain prevalance, users are increasingly exposed to the risks such systems entail. Prompt injection attacks, as well as hallucination, can cause agents to leak private information to third parties. As autonomous systems, agents also present the more active danger of performing sensiti...
PT-2026-58875
Name of the Vulnerable Software and Affected Versions ASUS System Control Interface v3 affected versions not specified ASUS System Control Interface affected versions not specified ASUS Business Manager affected versions not specified Description An out-of-bounds read exists in the software that...
(Pwn2Own) Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability
This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the exposed USB interface. The issue results from...
CVE-2026-30618
xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulti...
PT-2026-60246
Dell ThinOS 10, versions prior to 2605 10.2100, contain an Obsolete Feature in UI vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...
CVE-2026-30618
xszyou Fay 4.3.1 contains a remote code execution vulnerability in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulti...
ipmi-oem DoS
The vulnerability of the ipmi-oem software for intra-band and out-of-band data transmission over the IPMI FreeIPMI protocol is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...
PT-2026-60390
Name of the Vulnerable Software and Affected Versions MCP Documentation Server version 1.13.0 Description The Web UI and document-management API bind to all network interfaces by default instead of localhost, and the API does not require authentication. This allows a network-reachable client on t...
PT-2026-58893
Name of the Vulnerable Software and Affected Versions Apache Fineract versions prior to 1.14.1 Description An issue exists in the Report Execution API 'runreports' endpoint where report parameter values are incorporated into the generated SQL query without sufficient validation. This allows an...
PT-2026-58871
Improper Neutralization of Special Elements used in an SQL Command "SQL Injection" in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation Refer to the ' ...
ROS-20260715-73-0012
The vulnerability of Google Chrome’s user interface is related to errors in how information is presented on the user interface. Exploiting this vulnerability can allow a remote attacker to execute a spear-phishing attack...
PT-2026-58874
Name of the Vulnerable Software and Affected Versions ASUS System Control Interface v3 affected versions not specified ASUS System Control Interface affected versions not specified ASUS Business Manager affected versions not specified Description An untrusted pointer dereference exists in the...
PT-2026-60355
MantisBT 2.28.3 and earlier versions contains a SQL injection vulnerability in core/history api.php. The history order configuration value is concatenated directly into a SQL ORDER BY clause without any sanitisation, parameterization, or validation against a whitelist. An administrator can set th...
CVE-2026-1562: Improper Neutralization of Input During Web Page Generation
Pega Platform versions 8.1.0 through 25.1.2 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...