CVE-2026-101204: Out-of-bounds Read

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure bu...

CVE-2026-101202: Out-of-bounds Write

A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipulation can lead to out-of-bounds write. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure b...

PT-2026-99882

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...

PT-2026-102371

Name of the Vulnerable Software and Affected Versions FastStone Image Viewer versions prior to 8.4 Description A flaw in the TGA Image Handler component allows a remote attacker to trigger an out-of-bounds write, which occurs when data is written outside the intended memory boundary of a buffer...

ROS-20260928-73-0010

The vulnerability of the bpfprogtestrunxdp function in the kernel/bpf/core.c file, which is part of the BPF interpreter support for Linux kernel, relates to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2026-101003: Stack-based Buffer Overflow

A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The...

CVE-2026-101082: Improper Limitation of a Pathname to a Restricted Directory

A weakness has been identified in PMWeb 7.x/8.x/2025.x. This issue affects some unknown processing of the file downloader.aspx. This manipulation of the argument FullFileName/FileName causes path traversal. The attack may be initiated remotely. The exploit has been made available to the public an...

PT-2026-99757

Name of the Vulnerable Software and Affected Versions athlon1600 youtube-downloader versions prior to 4.0.2 Description Remote attackers can perform server-side request forgery SSRF by manipulating the url argument within the stream function located in the public/stream.php file. Server-side...

CVE-2026-101072: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /apip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-101011: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function getdomainstatus of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the...

PT-2026-99763

Name of the Vulnerable Software and Affected Versions Eyeplus version 57.0.0.0308 Description A remote stack-based buffer overflow exists within the p2pcam HTTP Parser component. This issue occurs when an unknown function fails to properly handle input, allowing a remote attacker to trigger the...

PT-2026-99925

Name of the Vulnerable Software and Affected Versions SUSE Rancher versions prior to 2.15.2 Description Incorrect credential cleaning during the logout process allows remote attackers to retain access credentials after an account has been logged out. Recommendations Update to version 2.15.2...

PT-2026-102400

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description Remote command injection is possible due to improper processing of the /api/ZRQos/set online client endpoint. An attacker can exploit this by manipulating the mac argument to execute arbitrary...

CVE-2026-101053: Improper Access Control

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit...

CVE-2026-101071: Unrestricted Upload of File with Dangerous Type

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown code of the file /exchange/attachment/upload of the component Upload Endpoint. This manipulation of the argument File causes unrestricted upload. The attack can be initiated...

CVE-2026-88805: Insufficient Session Expiration

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...

ROS-20260928-73-0115

The vulnerability of the walkstackframe function in the arch/riscv/kernel/stacktrace.c file, a subsystem for module management on the RISCV architecture of the Linux operating system’s kernel, relates to reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker,...

ROS-20260928-73-0042

The vulnerability of the modules net/sctp/smmakechunk.c and net/sctp/smstatefuns.c in the Linux operating system is related to the disclosure of information due to timing mismatches. Exploiting this vulnerability can allow an attacker, working remotely, to gain unauthorized access to protected...

PT-2026-99881

A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers/runners.js of the component Files Endpoint. The manipulation of the argument runid leads to path traversal. The attack is possible to be...

PT-2026-99817

Name of the Vulnerable Software and Affected Versions Trusted Domain Project OpenDMARC versions prior to 1.4.3 Description A remote attack is possible due to the improper handling of exceptional conditions within the strcasecmp function located in the libopendmarc/opendmarc policy.c library...