CVE-2026-101010: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument logtype leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

CVE-2026-101072: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /apip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-101053: Improper Access Control

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit...

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise applications relates to the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office and Microsoft 365 Apps for Enterprise applications is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code remotely...

The vulnerability of the RedisArrayAggregator component in the networking application development framework, developed using Netty protocols, allows a attacker to cause service interruptions.

The vulnerability of the RedisArrayAggregator component in the networking application development framework, as well as in servers and client protocols using Netty, stems from the lack of memory release after the effective lifespan of the component has ended. Exploiting this vulnerability allows ...

The vulnerability of the “record-output” parameter at the final destination /instances/$name/exec of the Docker control system and the Incus virtual machine manager allows a attacker to execute arbitrary commands.

The vulnerability of the “record-output” parameter at the final destination /instances/$name/exec of the Docker control system and the Incus virtual machine manager is related to improper external management of file names or file paths. Exploiting this vulnerability allows a remote attacker to...

The vulnerability of the PHPseclib cryptographic protocol interpreter library, related to insufficient validation of incoming requests, allows a hacker to execute a SSRF attack.

The vulnerability of the PHPseclib cryptographic protocol interpreter library is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform a SSRF attack remotely...

The vulnerability of the MinIO object storage server, related to the unlimited distribution of resources, allows a attacker to cause a service failure.

The vulnerability of the MinIO object storage server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of the DnsResolveContext component in the framework for developing network applications, servers, and clients using the Netty protocol allows a hacker to bypass security restrictions.

The vulnerability of the DnsResolveContext component in the framework for developing network applications, servers, and Netty protocol clients is related to insufficient verification of data authenticity. Exploiting this vulnerability can allow an attacker to bypass security restrictions remotely...

The vulnerability of services for the NFS ONCRPC XDR operating system allows a hacker to trigger a service failure.

The vulnerability of services for the NFS ONCRPC XDR operating system lies in reading data beyond the allowed range of memory. Exploiting this vulnerability can allow a remote attacker to cause service failures...

The vulnerability of the IpSubnetFilterRule.compareTo() function in the framework for developing network applications, servers, and clients using the Netty protocol allows a hacker to bypass security restrictions.

The vulnerability of the IpSubnetFilterRule.compareTo function in the framework for developing network applications, servers, and Netty protocol clients is related to improper checking of the specified data type for input data. Exploiting this vulnerability can allow an attacker to bypass securit...

The vulnerability of the container management system and the virtual machine manager Incus, related to improper external control of file names or file paths, allows attackers to execute arbitrary commands.

The vulnerability of the container management system and the virtual machine manager Incus is related to improper external control of the file name or path. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the sub_410188() function in TOTOLINK A3002MU router microprogramming software allows a intruder to trigger a service failure.

The vulnerability of the sub410188 function in TOTOLINK A3002MU router microprogramming systems is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

The vulnerability of Windows operating systems’ message queues allows a perpetrator to execute arbitrary code.

The vulnerability of Message Queuing in Windows operating systems relates to the possibility of exploiting memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the validation mechanism for the compression algorithm of the container management system and the Incus virtual machine manager allows a perpetrator to execute arbitrary commands.

The vulnerability of the validation mechanism for the compression algorithm of the container management system and the Incus virtual machine manager relates to insufficient checking of input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

The vulnerability of OpenBao’s secret and encryption management system, related to inadequate access control, allows attackers to enhance their privileges.

The vulnerability of the OpenBao encryption and secret management system is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the PHP interpreter, related to the assignment of the null pointer, allows attackers to trigger a service failure.

The vulnerability of the PHP interpreter is related to pointer operations. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

The vulnerability of the strcpy() function in the /goform/setSysAdm function of the UTT 1250GW networking device’s microprogramming system allows a hacker to cause a service failure.

The vulnerability of the strcpy function in the /goform/setSysAdm function of the UTT 1250GW networking device’s microprogramming system is related to the copying of buffers without checking the size of the input data when processing the GroupName parameter. Exploiting this vulnerability could...

The vulnerability of TP-Link Archer VX1800v V1’s microprogramming software lies in the failure to implement measures to eliminate CRLF sequences. This allows attackers to alter user account roles and gain administrator privileges.

The vulnerability of TP-Link Archer VX1800v V1 microprogramming software is related to the lack of measures taken to eliminate CRLF sequences. Exploiting this vulnerability allows a remote attacker to alter account roles and gain administrator privileges...

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to improper external management of file names or paths. This allows attackers to escalate their privileges.

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to improper external management of file names or paths. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...