PT-2026-78836

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-755AP versions prior to 20260702 Description A command injection flaw exists in the ssi component within the /cgi-bin/email.cgi endpoint. The issue resides in the log email server function, allowing a remote attacker to execute...

PT-2026-78719

A security flaw has been discovered in TRENDnet TV-IP751WIC 11.03.03. Affected by this issue is some unknown functionality of the file /cgi-bin/admin/set time.cgi of the component alphapd. The manipulation of the argument Currenttime results in stack-based buffer overflow. The attack can be...

CVE-2026-62377

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62377 libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-62377 libheif: Reachable assertion in HeifContext::get_track() aborts on a valid-but-empty HEIF sequence file (context.cc:2110)

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.0 and earlier, a crafted HEIF sequence accepted by heifcontextreadfrommemory can leave the context with no registered sequence tracks and crash when heifcontextgettrackctx, 0 is called. HeifContext::gettrack in libheif/context.cc...

CVE-2026-70802

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-70804

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-61755

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-61753

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-61324

Vulnerability in the Oracle Public Sector Financials International product of Oracle E-Business Suite component: Authorization. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

CVE-2026-75876

EasyReport versions up to 2.0.17.0522_Beta contain a SQL injection in ModuleController.java via the sourcePath argument in the Move Operations component, exploitable remotely with low privileges; CVSS 6.3 (Medium) with proof-of-concept exploit disclosed; no patch version provided, project unrespo...

CVE-2026-75784 TRENDnet TEW-WLC100 HTTP Header nginx FUN_0040da4c stack-based overflow

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched...

EUVD-2026-60773

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched...

CVE-2026-75784

TRENDnet TEW-WLC100 (firmware 1v2.07b01) nginx HTTP Header Handler function FUN_0040da4c allows remote unauthenticated stack-based buffer overflow via the Server argument. CVSS 10.0 critical; proof-of-concept exploit is public at https://github.com/meishigana/CVE/blob/main/team15_20260702/02_wlc1...

CVE-2026-75778

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-75783

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within...

CVE-2026-75783 TRENDnet TEW-WLC100P DHCP blobmsg netifd stack-based overflow

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within...

CVE-2026-75783

TRENDnet TEW-WLC100P firmware 12.07b01 contains a stack-based buffer overflow in the DHCP blobmsg handler of /sbin/netifd, triggered by crafted DHCP messages from an adjacent network attacker. CVSS 3.1 scores it CRITICAL (9.6) with complete confidentiality, integrity, and availability impact. A p...

CVE-2026-75774

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation causes improper authentication. It is possible to initiate the attack remotely. The complexity of...

CVE-2026-75778 code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...