The vulnerability of the fromRouteStatic function (/goform/RouteStatic) in the Tenda CX12L Wi-Fi router software allows a hacker to trigger a service failure.

The vulnerability of the fromRouteStatic function /goform/RouteStatic in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending a specially crafted POST request...

The vulnerability of the fromwebExcptypemanFilter() function (/goform/webExcptypemanFilter) in the httpd component of the Tenda F451 router microprogramming system, which allows a hacker to cause a service failure.

The vulnerability of the fromwebExcptypemanFilter function /goform/webExcptypemanFilter in the httpd component of the Tenda F451 router microprogramming system is related to the issue of the operation going beyond the buffer in memory when processing the page parameter. Exploiting this...

The vulnerability of the fromNatStaticSetting function (/goform/NatStaticSetting) in the Tenda CX12L Wi-Fi router software allows a intruder to trigger a service failure.

The vulnerability of the fromNatStaticSetting function /goform/NatStaticSetting in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST request...

PT-2026-95544

Name of the Vulnerable Software and Affected Versions LMDeploy versions 0.9.2 through 0.15.9 Description LMDeploy's PyTorch DistServe/PD-disaggregation control plane uses the recv pyobj function to deserialize messages received through a ZeroMQ PULL socket. This function relies on Python pickle...

WordPress Core <= 7.1 - Author+ Private Parent Post Title Disclosure vulnerability

Author+ Private Parent Post Title Disclosure vulnerability discovered by HDWSec in WordPress core versions = 7.1...

WordPress Core <= 7.1 - Contributor+ Arbitrary Post Overwrite vulnerability

Contributor+ Arbitrary Post Overwrite vulnerability discovered by Anthropic in WordPress core versions = 7.1...

CVE-2026-54596 ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-54596 ITFlow: Authenticated SQL Injection via recurring_invoice_frequency Parameter Enables Full Database Exfiltration

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with access to at least one client invoice can inject SQL through the frequency parameter handled by...

CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and...

CVE-2026-54460 OpenReception: Unauthenticated WebAuthn passkey injection via `POST /api/auth/passkeys` leads to account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to 1.1.1, POST /api/auth/passkeys accepts a request-body userId and attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and...

WordPress WP Easy Pay – Payment and Donation Form Builder for Square plugin <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin WP EasyPay versions = 4.5.0...

WordPress Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Post Modification / Site-Wide Template Takeover vulnerability discovered by Wordfence PRISM in WordPress Plugin Magazine Blocks versions = 1.8.6...

WordPress Filter Gallery plugin <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Modification vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Filter Gallery versions = 1.1.4...

CVE-2026-24074

creationtimestamp| type| source ---|---|--- 2026-09-17 11:38:58+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mvpkxewi3z2b...

DEBIAN-CVE-2026-86320

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

CVE-2026-86320

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

CVE-2026-86320 Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

CVE-2026-86320

CVE-2026-86320 affects flatpak-builder , a build tool for creating Flatpak applications. When applying patch sources with use-git-am: true, Git hooks are not disabled, allowing an attacker who supplies a malicious source containing a post-applypatch hook to execute arbitrary code on the host duri...

CVE-2026-86320 Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

CVE-2026-86320

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...