CVE-2026-92860: Improper Input Validation

A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. Th...

PT-2026-94230

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description An Improper Neutralization of Special Elements used in an OS Command, known as OS Command Injection, allows an unauthenticated remote attacker to execute arbitrary...

PT-2026-94290

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description A Cross-Site Request Forgery CSRF issue exists where an unauthenticated attacker with remote access could potentially execute commands remotely. CSRF is a flaw that...

CVE-2026-93379: Incorrect Authorization

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. Chromium security severity: Low...

CVE-2026-93436: Missing Release of Memory after Effective Lifetime

vLLM through 0.29.0 fails to properly clean up decode-side metadata for rejected inference requests in prefill/decode disaggregated deployments. Remote attackers can submit requests with maxtokens=0 to exhaust decode-worker memory without bound until the worker restarts...

PT-2026-94339

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description A Server-Side Request Forgery SSRF issue exists where a low privileged attacker with remote access could potentially exploit the system to induce the server to make...

CVE-2026-93374: Use After Free

Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-54617: Improper Limitation of a Pathname to a Restricted Directory

GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request target without a leading slash to the default LaunchServer file server on port 9274. FileServerHandler.channelRead0 in...

CVE-2026-54510: Improper Authentication

Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.21-alpha, the csrfexemptforapitokens beforerequest hook in src/app.py calls csrf.exemptviewfunc, permanently adding the selected view to Flask-WTF's process-global exemption set. The...

PT-2026-95181

Name of the Vulnerable Software and Affected Versions Microsoft Fabric affected versions not specified Description An authentication bypass by spoofing exists in Microsoft Fabric. This issue allows an unauthenticated remote attacker to provide crafted identity assertions that are accepted as...

MikroTik RouterOS Cryptographic Signature

The vulnerability of the MikroTik RouterOS operating system is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to perform TLS server substitution remotely...

CVE-2026-54670: Improper Limitation of a Pathname to a Restricted Directory

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive...

PT-2026-95164

Name of the Vulnerable Software and Affected Versions vLLM versions prior to 0.29.1 Description In prefill/decode disaggregated deployments, the software fails to properly clean up decode-side metadata for rejected inference requests. A remote attacker can submit multiple requests using the max...

CVE-2026-20121

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

EUVD-2026-81124

A vulnerability in Cisco ISE could allow an unauthenticated, remote attacker to conduct SQL injection attacks on an affected device. This vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected...

CVE-2026-92526 itsourcecode Leave Management System index.php sql injection

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used...

CVE-2026-92416

A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smfn4handlesessionreportrequest of the file src/smf/n4-handler.c of the component PFCP Session Report Request Handler. The manipulation leads to reachable assertion. The attack may be initiated remotely...

CVE-2026-92413

A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdfopenfilter of the file pdf-stream.c of the component PDF Xref Loading. Executing a manipulation can lead to null pointer dereference. The attack can be launched...

CVE-2026-51990

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

EUVD-2026-80936

A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogspfcpparsevolumemeasurement in the library lib/pfcp/types.c of the component PFCP Handler. The manipulation results in null pointer dereference. The attack may be launched remotely. The patch is identified as...