CVE-2026-94098 Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...

Incus uploadDir S3 Arbitrary Command Execution

The vulnerability of the uploadDir function in the internal/server/storage/s3/local/multipart.go file of the container management system and the virtual machine manager Incus is related to improper external manipulation of the file name or path. Exploiting this vulnerability allows a remote...

PT-2026-96238

Name of the Vulnerable Software and Affected Versions OpenCanary version 0.9.9 Description The Redis module contains a flaw that allows an unauthenticated remote attacker to cause unconstrained memory usage, leading to a Denial-of-Service DoS condition. Denial-of-Service is a state where a system...

PT-2026-96055

Name of the Vulnerable Software and Affected Versions Omega Solution FBP Fulfillment by People 2025 Description An authorization bypass exists within the User Profile API component in the /user/ file. Remote exploitation is possible by manipulating the ID argument, allowing an attacker to bypass...

ROS-20260921-73-0036

The vulnerability in curl is related to the disclosure of information during data transmission. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

CVE-2026-73511: Authentication Bypass by Alternate Name

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

ROS-20260921-73-0074

The vulnerability in the incus is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260921-73-0058

The vulnerability in etcd is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

MediaWiki Unauthorized Access

The vulnerability of the infoAction.php script used in the MediaWiki hypertext environment involves insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

TOTOLINK A3300R SetVpnPassCfg Command Execution

The vulnerability of the setVpnPassCfg function in TOTOLINK A3300R router microprogramming software is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

NPM vm2 Code Execution

The vulnerability of the NPM packet manager’s library vm2 is related to a breach in data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

DHCP Server Windows Code Execution

The vulnerability of DHCP servers for Windows operating systems is related to the execution of operations beyond the buffer in memory. Exploitation of this vulnerability can allow a remote attacker to execute arbitrary code...

TOTOLINK A3300R SetLanCfg Command Execution

The vulnerability of the setLanCfg function in TOTOLINK A3300R router microprogramming systems lies in the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2026-96100

A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot. The vulnerability is accessible when the Redis service is enabled only. The Canary is NOT affected if the Redis service is disabled...

CVE-2026-85219: Allocation of Resources Without Limits or Throttling

Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage...

CVE-2026-94096: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/networktools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched...

CVE-2026-36471: Deserialization of Untrusted Data

Deserialization of Untrusted Data of the postdata parameter in cnparseurl in CuteNews v.2.1.2 allows a remote attacker to inject arbitrary values into internal request variables including referer via a crafted base64-encoded serialized PHP payload submitted as a POST parameter...

CVE-2026-75939: Improper Verification of Cryptographic Signature

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP Pretty Good Privacy release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulatin...

CVE-2026-85220: Allocation of Resources Without Limits or Throttling

A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot. The vulnerability is accessible when the Redis service is enabled only. The Canary is NOT affected if the Redis service is disabled...

CVE-2026-94211: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/Dashboard/Templates/show.blade.php of the component Project Dashboard. Such manipulation leads to cross site scripting. The attack may be performed from remot...