EUVD-2026-53705

A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function selecttools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carri...

CVE-2026-18992 zhayujie CowAgent Self-Evolution Review Agent executor.py _select_tools authorization

A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function selecttools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carri...

EUVD-2026-53695

A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function getfilecontent of the file server.py of the component executetoolmanually Endpoint. The manipulation of the argument toolname/toolparams results in information disclosure. The attack can be launched...

CVE-2026-18968

A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit...

The vulnerability of the bcm_vk_read() function in the drivers/misc/bcm-vk/bcm_vk_msg.c module of the Linux kernel allows a hacker to cause a service failure.

The vulnerability of the bcmvkread function in the drivers/misc/bcm-vk/bcmvkmsg.c file of the Linux kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerabilities of the functions cmpc_accel_sensitivity_show_v4() and cmpc_accel_sensitivity_store_v4() in the module drivers/platform/x86/classmate-laptop.c of the X86 device driver framework of the Linux operating system, which allow a malicious actor to cause service failures.

The vulnerabilities of the functions cmpcaccelsensitivityshowv4 and cmpcaccelsensitivitystorev4 in the driver/platform/x86/classmate-laptop.c file of the Linux kernel device driver framework are related to pointer manipulation. Exploiting these vulnerabilities can allow attackers to cause system...

The vulnerability of the acpi_processor_errata_piix4() function in the drivers/acpi/acpi_processor.c driver of the ACPI driver module for the Linux kernel allows a attacker to cause a system failure.

The vulnerability of the acpiprocessorerratapiix4 function in the drivers/acpi/acpiprocessor.c file of the ACPI driver for the Linux kernel is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system failure...

MiracleLinux 9 : unbound-1.24.2-3.el9_8.2 (AXSA:2026-1474:09)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1474:09 advisory. unbound: Unbound: Denial of Service via excessive EDNS options CVE-2026-41292 unbound: Unbound: Cache manipulation via 'ghost domain names' attack...

CVE-2026-18958

A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. The manipulation of the...

EUVD-2026-53470

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-0516

A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains...

WordPress Layouts for WPBakery plugin <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation vulnerability

Missing Authorization to Unauthenticated Template Cache Manipulation vulnerability discovered by murd0ck, Patricio Briones CyberDoomer in WordPress Plugin Layouts for WPBakery versions = 1.1.3...

EUVD-2026-53334

A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains...

FreeRDP: FreeRDP: Remote code execution via heap out-of-bounds write in RemoteFX decoding

A flaw was found in FreeRDP. FreeRDP clients using the non-default /cache:codec:rfx option are vulnerable to a heap out-of-bounds write. A malicious Remote Desktop Protocol RDP server can exploit this by manipulating desktop stride and height values during RemoteFX decoding for Cache Bitmap V3...

Malicious code in agent-bot-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299eb5fe496022e888ed0663d0be82ddb8fac108bcb9a223291449982c360530 Package establishes a persistent remote-access channel to the hardcoded server https://server.junofficial.biz.id. On load, the client posts the...

CVE-2026-8761

The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the CustomersController REST controller includes/REST/CustomersController.php, which re-registers WooCommerce's customer CRUD routes...

CVE-2026-18901

A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

CVE-2026-18901

The CVE-2026-18901 entry concerns H3C NX15 V100R017 Web API. The vulnerable component is the function service.add in the /api/esps endpoint, whose manipulation can expose a dangerous routine. The vulnerability is exploitable remotely, and public exploits/PoCs have been disclosed. References indic...