CVE-2026-92217: Improperly Controlled Modification of Dynamically-Determined Object Attributes

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...

CVE-2026-92215: Server-Side Request Forgery (SSRF)

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agentsdks/python/a2uiagent/src/a2ui/extensions/fileresolve/fileresolver.py of the component FileResolver. The manipulation leads to server-side request forgery. I...

CVE-2026-92221: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generateindexpasien of the file application/models/appglobaladminmodel.php. Executing a manipulation of the argument cari can lead to sql...

CVE-2026-92220: Uncontrolled Resource Consumption

A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.requestfinished/MoRIIOConnectorWorker.getfinished/MoRIIOWrapper.handlereleasemessage of the file vllm/distributed/kvtransfer/kvconnector/v1/moriio/moriioconnector.py of the component...

CVE-2026-92398: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in Ruijie RG-EW3000GX EW3.01B11P380. Affected by this issue is some unknown functionality of the file /etc/rgconfig/admin of the component userlistnote Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate the...

CVE-2026-27565: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...

CVE-2026-27563: Improper Neutralization of Special Elements used in an OS Command

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27558: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/ajaxremoveuploadedioddfiles endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27557: Path Traversal: '.../...//'

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/viewuploadedioddfile endpoint allowing the SSH server's private keys to be read...

CVE-2026-27554: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27547: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27553: Exposure of Sensitive System Information to an Unauthorized Control Sphere

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...

CVE-2026-27550: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the FieldShadowPassword class using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27546: Authentication Bypass Using an Alternate Path or Channel

An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...

CVE-2026-92184: Server-Side Request Forgery (SSRF)

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forger...

CVE-2026-92216: URL Redirection to Untrusted Site

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible to launch the attack remotely. The proje...

PT-2026-94035

Name of the Vulnerable Software and Affected Versions SafeLine versions prior to 9.4.2 Description The management console session-signing secret is derived from a time-seeded math/rand generator. This allows unauthenticated remote attackers who can determine the installation timestamp to...

CVE-2026-27552: Incorrect Authorization

A low-privileged remote attacker can exploit improper authorization in the /index.php/attacheddevicestab/doupload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes...

CVE-2026-20121: Improper Access Control

A vulnerability in the access control list ACL Object Group Search OGS implementation of Cisco Secure Firewall Adaptive Security Appliance ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to bypass configured access controls. This...

PT-2026-94021

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/leave/index.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used...