PT-2026-90869

A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/chat/index.vue of the component chat sendMsg Endpoint. Such manipulation of the argument chat msg leads to cross site scripting. The attack...

PT-2026-90823

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function get surge subscription of the file services/subscription.py of the component Subscription Handler. Such manipulation of the argument key leads to improper access...

PT-2026-90828

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made...

PT-2026-90802

A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has bee...

PT-2026-90801

A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userface of the component Avatar Upload. This manipulation of the argument File causes unrestricted upload. The attack is possible to be carried out remotely. The...

PT-2026-90820

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted element is the function authorized. The manipulation of the argument SECRET KEY leads to missing authentication. The attack can be initiated remotely. The exploit has been...

PT-2026-90779

A security vulnerability has been detected in webgjc web robot 2.4.0/2.5.0/2.8.0. The affected element is the function controller listen/controller recover of the file py/web.py. The manipulation of the argument case name leads to os command injection. It is possible to initiate the attack...

PT-2026-90788

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update system module order/update dimension order of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims...

PT-2026-90942

A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gf node list add child of the file scenegraph/base scenegraph.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The...

PT-2026-90979

A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserController.updateUser of the file UserController.java. Performing a manipulation of the argument userid results in authorization bypas...

CVE-2026-35867

A Command Injection vulnerability exists in the bsSetLimitCliinfo function within the libshare.so library of the LB-LINK router AC1900AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/setLimitClientcfg" call but does not...

PT-2026-90872

A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The...

PT-2026-90852

A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of the file sidebar.php. The manipulation of the argument UserType results in improper access controls. The attack may be launched remotely. The exploit has been released to the...

PT-2026-90862

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust pos trans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2023-002405)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002405 advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid has...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ctags (UTSA-2023-002841)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002841 advisory. A flaw was found in Exuberant Ctags in the way it handles the -o option. This option specifies the tag filename. A crafted tag filename specified in the command line...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: xorg-x11-server (UTSA-2022-000902)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000902 advisory. A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb....

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: glibc (UTSA-2023-000634)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000634 advisory. DISPUTED A vulnerability was found in GNU C Library 2.38. It has been declared as critical. This vulnerability affects the function monstartup of the file gmon.c of...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: emacs (UTSA-2022-000996)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-000996 advisory. GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C...

PT-2026-90871

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this vulnerability is the function createUserAccount of the file register.php of the component Registration Handler. Executing a manipulation of the argument usertype...