PT-2026-35662

A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function delete menu of the file /admin/ajax.php?action=delete menu. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploi...

PT-2026-35572

Name of the Vulnerable Software and Affected Versions Totolink A8000RU version 7.1cu.643 b20200521 Description OS command injection can be triggered remotely via the CGI Handler component. The issue exists in the setUrlFilterRules function within the '/cgi-bin/cstecgi.cgi' endpoint, where imprope...

PT-2026-35813

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function delete category of the file /admin/ajax.php?action=delete category. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public an...

PT-2026-35672

A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith of the file scripts/component server/server.js. Executing a manipulation of the argument request.url can lead to path traversal. The attack can be launched remotely. The exploi...

PT-2026-35648

Name of the Vulnerable Software and Affected Versions donchelo processing-claude-mcp-bridge versions up to e017b20a4b592a45531a6392f494007f04e661bd Description A path traversal issue exists in the create sketch Tool within the processing server.py file. This occurs due to improper manipulation of...

PT-2026-35586

Name of the Vulnerable Software and Affected Versions ef10007 MLOps MCP version 1.0.0 Description A path traversal issue exists in the save file Tool within the fastmcp server.py file. A remote attacker can manipulate the filename/destination argument to access or overwrite files outside the...

PT-2026-35576

Name of the Vulnerable Software and Affected Versions dvladimirov MCP versions prior to 0.1.1 Description A command injection flaw exists in the Git Search API component within the GitSearchRequest function of the mcp server.py file. A remote attacker can execute this by manipulating the repo url...

PT-2026-35830

Name of the Vulnerable Software and Affected Versions Grav CMS versions 1.7.44 through 2.0.0-beta.1 Description An insecure deserialization issue exists in the Cache Value Handler component. The doGet function within the system/src/Grav/Framework/Cache/Adapter/FileCache.php file uses unserialize...

PT-2026-35831

Name of the Vulnerable Software and Affected Versions elie mcp-project version 0.1.0 Description A path traversal issue exists in the search papers function within the research server.py file. This occurs when the topic argument is manipulated, allowing for unauthorized file system access. Local...

PT-2026-35829

Name of the Vulnerable Software and Affected Versions eiliyaabedini aider-mcp versions up to 667b914301aada695aab0e46d1fb3a7d5e32c8af Description A command injection issue exists within the code with ai component in the aider mcp.py file. A remote attacker can trigger this by manipulating the...

PT-2026-35574

Name of the Vulnerable Software and Affected Versions duartium papers-mcp-server version 9ceb3812a6458ba7922ca24a7406f8807bc55598 Description A path traversal issue exists in the search papers function within the src/main.py file. This occurs when the topic argument is manipulated, allowing a...

PT-2026-35655

Name of the Vulnerable Software and Affected Versions BigSweetPotatoStudio HyperChat versions prior to 2.0.0-alpha.64 Description A server-side request forgery SSRF issue exists in the AI Proxy Middleware component. The fetch function within the packages/core/src/http/aiProxyMiddleware.mts file...

PT-2026-35710

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. The impacted element is the function save order of the file /admin/ajax.php?action=save order. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public...

PT-2026-35694

A vulnerability has been found in D-Link DI-8100 16.07.26A1. Affected by this issue is the function file exten asp of the file file exten.asp of the component File Extension Handler. The manipulation of the argument Name leads to buffer overflow. Remote exploitation of the attack is possible. The...

PT-2026-35732

A vulnerability was identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function delete expired of the file /ajax.php?action=delete expired. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit i...

PT-2026-35587

Name of the Vulnerable Software and Affected Versions eghuzefa engineer-your-data versions prior to 0.1.4 Description A path traversal issue exists in the src/server.py file. The manipulation of the WORKSPACE PATH argument within the read file, write file, list files, and file inf functions allow...

Linux Distros Unpatched Vulnerability : CVE-2026-7135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in GPAC up to 26.03-DEV-rev105-g8f39a1eb3-master. Affected by this vulnerability is the function elngboxread of the file...

CVE-2026-7199

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=deleteproduct. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the atta...

EUVD-2026-25954

A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=deleteproduct. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the atta...

EUVD-2026-25934

A weakness has been identified in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=saveproduct. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been...