CVE-2026-101007 aaPanel BaoTa Database Backup database.py InputSql os command injection

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2026-101007 aaPanel BaoTa Database Backup database.py InputSql os command injection

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

EUVD-2026-88103

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2026-101003

A flaw was found in Mongoose. A remote attacker can trigger a stack-based buffer overflow by sending specially crafted network messages to the MQTT broker component. This flaw could lead to a Denial of Service DoS condition by crashing the application...

CVE-2026-101003

A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The...

CVE-2026-101004

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-101002

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/networktools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. Th...

CVE-2026-101006

The software Frappe HR (up to version 16.15.0 ) is vulnerable to a Permission Validation flaw located in the file hrms/api/__init__.py. Specifically, the functions get_expense_claims, get_shift_requests, and get_attendance_requests are susceptible to incorrect authorization when the employee argu...

CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-101005 October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

EUVD-2026-88093

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

CVE-2026-101005

A server-side request forgery (SSRF) vulnerability exists in October CMS versions up to 4.3.4 . The flaw is located in the validateExternalImageHost function within the System/Classes/ResizeImages.php file of the SSRF Protection component. An unauthenticated remote attacker can exploit this vulne...

EUVD-2026-88090

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-101004 notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-101004 notionnext-org NotionNext Authentication Guard cache.js cleanCache missing authentication

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-101004

A security vulnerability exists in notionnext-org NotionNext up to version 4.10.10 within the Authentication Guard component. The flaw resides in the cleanCache function of the pages/api/cache.js file, where manipulating the token argument leads to missing authentication . This allows for remote ...

EUVD-2026-88089

A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The...

CVE-2026-101003 Cesanta Mongoose MQTT Broker main.c fn stack-based overflow

A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The...

CVE-2026-101003

Cesanta Mongoose versions up to 7.21 are vulnerable to a stack-based buffer overflow within the MQTT Broker component. The flaw exists in the fn function located in tutorials/mqtt/mqtt-server/main.c. A remote attacker can trigger this vulnerability through a manipulation, potentially leading to a...