CVE-2026-75978

In xianrendzw EasyReport up to 2.0.17.0522_Beta, the function DataSourceController.add in DataSourceController.java allows remote manipulation of the queryerClass argument, causing permission issues exploitable with low privileges; no vendor patch is available yet, and a PoC has been disclosed pu...

Linux Distros Unpatched Vulnerability : CVE-2026-75904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libmodplug through 0.8.9.1 contains an out-of-bounds read in patsmplooped in src/loadpat.cpp. The function validates only the upper bound of its sample index...

PT-2026-78258

A vulnerability has been found in code-projects Online Job Portal System 1.0. The impacted element is an unknown function of the file /ForPass.php of the component Password Recovery. Such manipulation of the argument txtUserName leads to sql injection. The attack may be launched remotely. The...

PT-2026-78267

The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCF Abilities Media::register replace-media-file execute callback function in all versio...

PT-2026-78264

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit h...

PT-2026-78265

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=save menu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-78260

A weakness has been identified in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formGroupConfig. Executing a manipulation of the argument timestart can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been mad...

PT-2026-78266

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been mad...

PT-2026-78839

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and coul...

PT-2026-78480

OpenEMR before 8.3.0 contains a path traversal vulnerability in the EDI archive restore function. The archrestore sel POST parameter is passed to the archive restore handler without sanitization for path traversal sequences. The handler checks whether the supplied path exists on the filesystem, a...

PT-2026-78529

FFmpeg before commit 65b0dab contains an out-of-bounds read in the DASH demuxer libavformat/dashdec.c. When a live DASH manifest is refreshed with a startNumber that is lower than the previous value, the current sequence number is driven negative. The fragment retrieval function checked only the...

PT-2026-78554

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...

PT-2026-78546

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers0.url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding...

PT-2026-78439

MyBooks is anebook management web server also known as Talebook. In 3.41.2 and earlier, the SignUp.post handler for POST /api/user/sign up in webserver/handlers/user.py does not enforce the ALLOW REGISTER configuration flag, even though the frontend hides registration controls when the flag is...

PT-2026-78836

A security flaw has been discovered in TRENDnet TEW-755AP up to 20260702. This affects the function log email server of the file /cgi-bin/email.cgi of the component ssi. Performing a manipulation results in command injection. The attack is possible to be carried out remotely. The exploit has been...

The vulnerability of the formSetRebootTimer() function in the Tenda AC12 router microprogramming system, located in the file US_AC1206V1.0RTL_V15.03.06.23_multi_TD01.bin, allows a intruder to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the formSetRebootTimer function in the Tenda AC12 router’s file USAC1206V1.0RTLV15.03.06.23multiTD01.bin is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality,...

When Agents Go Rogue: The OpenClaw Supply Chain Crisis

When Agents Go Rogue: The OpenClaw Supply Chain Crisis By Aniket Choukde, Vikas Mishra and Yadunadh · August 19, 2026 This blog was also written by Akhil Reddy and Pavan Kumar Podila Executive Summary The cybersecurity landscape is currently undergoing a seismic shift driven by the adoption of...

ROS-20260819-73-0069

The vulnerability of the ipv6getdataprimitive function in the libnetutil/netutil.cc library, a networking scanning tool for Nmap, is related to a countable loss of significance. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

RDK-B WebUI contains multiple vulnerabilities

Overview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication,...

PT-2026-78252

A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522 Beta. The affected element is the function DataSourceController.add of the file DataSourceController.java of the component QueryerFactory. Such manipulation of the argument queryerClass leads to permission issue...