PT-2026-72050

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Doctors Appointment System version 1.0 Description An unrestricted upload issue exists in the /save file.php endpoint within the save doctor function. This flaw allows a remote attacker to upload files without proper...

PT-2026-71977

Name of the Vulnerable Software and Affected Versions Tenda AC12 version 15.03.06.23 multi TD01 Description A buffer overflow occurs in the httpd web management interface when the rebootTime argument is manipulated. This issue is located within the formSetRebootTimer function of the...

PT-2026-71949

Name of the Vulnerable Software and Affected Versions Baicells EG3661M version BaiCE BQ6 2.0.5.3 NA Description An OS command injection flaw exists in the LuCI Web Interface component. A remote attacker can exploit this by manipulating the MaxHops, Timeout, or Size arguments within the...

PT-2026-72041

A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may ...

PT-2026-72035

A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available an...

PT-2026-72049

A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The...

PT-2026-72018

Name of the Vulnerable Software and Affected Versions alldatacenter alldata versions prior to 0.6.9 Description A remote deserialization issue exists within the xxl-rpc Listener component, specifically in the Hessian2Input.readObject function located in the /serialize/impl/HessianSerializer.java...

PT-2026-71955

Name of the Vulnerable Software and Affected Versions Tenda AC1206 version 15.03.06.23 multi TD01 Description A stack-based buffer overflow exists in the httpd web management interface. The issue occurs within the set device name function located in the '/goform/SetOnlineDevName' endpoint when th...

CVE-2026-19758 dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal

A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely...

CVE-2026-19758 dromara lamp-cloud chunk-check endpoint FileChunkController.java path traversal

A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely...

CVE-2026-19753

A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function exploreurl of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be...

CVE-2026-19757

CVE-2026-19757 affects Dromara lamp-cloud up to version 5.10.0, specifically the File-Upload Controller FileAnyoneController.java. The vulnerability arises from manipulation of the bucket/bizType argument, enabling path traversal. Exploitation is remote and an exploit has been made public. The de...

CVE-2026-19757 Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated...

CVE-2026-19757 Dromara lamp-cloud File-Upload Controller FileAnyoneController.java path traversal

A vulnerability was found in Dromara lamp-cloud up to 5.10.0. This vulnerability affects unknown code of the file FileAnyoneController.java of the component File-Upload Controller. Performing a manipulation of the argument bucket/bizType results in path traversal. The attack can be initiated...

CVE-2026-19753

The CVE-2026-19753 entry concerns MCP Server’s MCP-rdf-explorer 1.0.0, specifically the explore_url function in src/mcp-rdf-explorer/server.py. A server-side request forgery (SSRF) vulnerability results from manipulating the url argument, with the attack described as potentially remotely initiabl...

CVE-2026-19752 EnzoVezzaro mcp-dominican-layer PDF Parsing index.ts parse-pdf server-side request forgery

A vulnerability was found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. This affects the function parse-pdf of the file src/index.ts of the component PDF Parsing. Performing a manipulation of the argument pdfUrl results in server-side request forgery. It is...

CVE-2026-19752

CVE-2026-19752 affects EnzoVezzaro’s mcp-dominican-layer (PDF Parsing), specifically the parse-pdf function in src/index.ts. A manipulation of the pdfUrl argument enables remote server-side request forgery (SSRF); exploitation is public and can be used. Documents indicate vulnerability details an...

CVE-2026-19749

A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to...

CVE-2026-19746

A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contact...

CVE-2026-19746

Calix GigaSpire 26.1.0 contains a vulnerability in the traceroute.cmd file where an unknown function can be manipulated to cause a denial of service. The issue can be triggered remotely, with public disclosure of the exploit. No remediation details are provided in the supplied documents. The vend...