CVE-2026-19963

A vulnerability has been found in Edimax EW-7478APC 1.04. Affected by this issue is the function stainfo of the file /goform/stainfo. The manipulation of the argument interface leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public...

CVE-2026-19966

CVE-2026-19966 affects CodeCanyon TimeCamp Integration for CRM (up to v2.8). The vulnerability resides in processing of /clients/save_contact, where manipulating contact_id can bypass authorization. It can be exploited remotely and a public exploit exists. The provided documents do not specify a ...

EUVD-2026-60011

A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/savecontact of the component Contact Information Update. Such manipulation of the argument contactid leads to authorization bypass. The attack can b...

CVE-2026-19966 CodeCanyon TimeCamp Integration for CRM Contact Information Update save_contact authorization

A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/savecontact of the component Contact Information Update. Such manipulation of the argument contactid leads to authorization bypass. The attack can b...

EUVD-2026-60010

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-19965 automad Password Reset Endpoint UserController.php requestPasswordResetToken response discrepancy

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the component Password Reset Endpoint. This manipulation of the argument name-or-email causes...

CVE-2026-19965

The CVE-2026-19965 affects automad up to version 2.0.0-beta.32. It targets the Password Reset Endpoint’s requestPasswordResetToken in automad/src/server/Controllers/API/UserController.php, where manipulation of the name-or-email argument causes observable response discrepancies. The issue can be ...

PT-2026-73181

A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save contact of the component Contact Information Update. Such manipulation of the argument contact id leads to authorization bypass. The attack can...

CVE-2026-50772

An issue in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function...

CVE-2026-67678

File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...

CVE-2026-68005

An issue in ACME minihttpd 1.30 and prior allows a remote attacker to cause a denial of service via the HTTP request header parser in the handlerequest function...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50776

Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - 04/2026 allows a remote attacker to obtain sensitive information and execute arbitrary code...

CVE-2026-67678

The Initial Description states a File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows remote arbitrary code execution, but the connected documents repeat the same one-line description and provide no additional technical details such as root cause, affected component, CVSS metrics,...

EUVD-2026-60352

An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manger role...

PT-2026-76871

A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to execute arbitrary code...

CVE-2026-67926

JeecgBoot v.3.9.2's AI Chat Module accepts unsanitized input via the files parameter, enabling a remote attacker to execute arbitrary code on the host. No patch version or exploit details are provided; the referenced GitHub issue (#9774) may contain further technical context. Exploitation in the ...

CVE-2026-67918

hermes-studio v0.6.26 contains a directory traversal flaw in the validatePath function of the api/hermes/download endpoint, allowing a remote attacker to read sensitive files outside the intended directory. No exploit code, CVSS score, or patch version is provided in the available documents. Expl...

PT-2026-73220

A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys 3DGS MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone Transformation Key Parser. The...

EUVD-2026-60312

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...