PT-2026-85699

CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: https://t.co/2JPeD1RjLr CVE infosec XSS valtersit snippet infosec SysAdmin cybersecurity...

PT-2026-85571

AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill path request parameter to copy files...

PT-2026-85573

surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that accept raw file path parameters. Attackers can read any image or PDF file on the host by supplying arbitrary file paths to Image.open or pypdfium2.PdfDocument...

PT-2026-85569

Name of the Vulnerable Software and Affected Versions Dub affected versions not specified Description An open redirect issue exists where the redir url query parameter is accepted on every short link without validation or domain allowlist enforcement. This allows attackers to append the redir url...

CVE-2026-75170

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

CVE-2026-75164

The MBS-Solutions X-Serie Gateway is affected by an arbitrary file read vulnerability in the /cgi-bin/ugwdownload.cgi component of firmware version V6_00_05 . A remote authenticated user with a low-privileged Standard role can exploit this by using the file query string parameter to retrieve arbi...

CVE-2026-75170

The HubCore platform (version 14.1.1) is vulnerable to a Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint. A remote unauthenticated attacker can inject arbitrary JavaScript into the application's response by exploiting the language POST parameter . Practical conse...

PT-2026-85380

A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv del.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be...

EUVD-2026-71443

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

CVE-2026-75164

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...

PT-2026-85387

A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used...

CVE-2026-79419

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to...

PT-2026-85541

Douyin TikTok Download API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video data endpoints that allows unauthenticated attackers to fetch arbitrary URLs by supplying a url query parameter. Attackers can request internal services includi...

CVE-2025-67066

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path...

PT-2026-85679

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6 00 05 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter...

Linux Distros Unpatched Vulnerability : CVE-2026-76177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Server-Side Request Forgery SSRF vulnerability in the /ocsreports/?function=teleactivate endpoint due to insufficient validation of the HTTPSSERV and FILESERV...

Linux Distros Unpatched Vulnerability : CVE-2026-76175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator...

PT-2026-86240

A flaw has been found in code-projects Online Shopping System 1.0. Impacted is the function mysqli query of the file admin/adduser.php. Executing a manipulation of the argument mobile can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be use...

PT-2026-85443

An authorization flaw in MISP allowed an authenticated user to submit a sharing group id without verifying that the user was authorized to use the referenced Sharing Group. In several attribute and Galaxy Cluster creation and editing workflows, validation of the submitted Sharing Group was...

PT-2026-85486

phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. Unauthenticated attackers can bypass CAPTCHA protection and submit unlimited questions directly, causing database pollution and triggering outgoing mail notifications...