PT-2026-106759

A security flaw has been discovered in vllm-project vLLM up to 0.31.0. This impacts the function get token bin counts and mask of the file vllm/model executor/layers/utils.py of the component Penalty Handler. Performing a manipulation results in denial of service. Remote exploitation of the attac...

PT-2026-106307

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

The vulnerability of the mime_content_type() function in the Piwigo content management system allows a hacker to execute arbitrary code and gain full control over the system.

The vulnerability of the mimecontenttype function in the Piwigo content management system is related to the unlimited loading of files of a dangerous type, due to the lack of strict checks on file extensions and content. Exploiting this vulnerability could allow an attacker operating remotely to...

Cisco ASA Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-2020-3561)

A vulnerability in the Clientless SSL VPN WebVPN of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to inject arbitrary HTTP headers in the responses of the affected system. The vulnerability is due to...

PT-2026-106859

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An uninitialized resource in the Media component allows a remote attacker to obtain cross-origin data, which is data from a different origin than the one serving the page, by using a...

Security Advisory 0189

Security Advisory 0189 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release Description All CVEs covered in this advisory affect platforms running CloudVision Portal On-Premises, where insufficient validations in the Software Management...

Security Advisory 0187

Security Advisory 0187 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release Description All CVEs covered in this advisory affect CloudVision Portal On-Premises, where specially crafted requests could result in user redirection to arbitrary...

PT-2026-106855

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description An observable discrepancy in Animation allows a remote attacker to potentially obtain cross-origin data by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-107312

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description Improper access control allows a remote authenticated attacker to execute arbitrary code. Recommendations Upgrade to version 1.12.3...

CVE-2026-106223: Use of Uninitialized Resource

Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-106210: Observable Discrepancy

Observable discrepancy in Scroll in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. Chromium security severity: Medium...

PT-2026-106313

A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors...

PT-2026-106719

A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation of the argument username/password resul...

PT-2026-106318

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the component Auth Guard. Such manipulation of the argument user id leads to improper authentication. The attack can be executed remotely. The exploit is publicly available and mig...

CVE-2026-106250: Missing Authorization

Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

PT-2026-106992

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.39 Description A use of released resource in the UI allows a remote attacker who has compromised the renderer process to spoof UI elements by using a crafted HTML page. Recommendations Update Google...

PT-2026-106321

A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user handler.go. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has...

PT-2026-106335

A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin transaction.php. This manipulation of the argument Username causes sql...

PT-2026-107196

Name of the Vulnerable Software and Affected Versions HPE Networking ClearPass Policy Manager Android client application affected versions not specified Description An improper access control issue allows application functionality to be invoked by untrusted sources. This could enable an...

PT-2026-107110

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.3.7.1 Description An authentication bypass exists in the Azure AD external login flow. A remote attacker can take over a user account by replaying a captured login-session token that is exposed within ...