CVE-2026-94216: Improper Neutralization of CRLF Sequences in HTTP Headers

A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of the component HTTP Request Handler. Executing a manipulation of the argument Success can lead to http response splitting. It is possible to launch the attack...

ROS-20260921-73-0074

The vulnerability in the incus is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-94096: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/networktools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched...

ROS-20260921-73-0058

The vulnerability in etcd is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-94214: URL Redirection to Untrusted Site

A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. Performing a manipulation of the argument Host results in open redirect. It is possible to initiate the attack remotely. The exploit has been made public and...

CVE-2026-94101: Buffer Copy without Checking Size of Input

A security vulnerability has been detected in Netcore NBR200V2 1.3.241127.071246. The affected element is the function vlanloadformuci of the file /usr/bin/routerd. The manipulation of the argument wannum leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has be...

CVE-2026-94099: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. This issue affects some unknown processing of the file restore.cgi of the component Backup Restore. Performing a manipulation of the argument QUERYSTRING results in command injection. The attack is possible to be carried o...

CVE-2026-94150: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been...

PT-2026-96100

A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack against the honeypot. The vulnerability is accessible when the Redis service is enabled only. The Canary is NOT affected if the Redis service is disabled...

CVE-2026-85219: Allocation of Resources Without Limits or Throttling

Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory usage...

MediaWiki Unauthorized Access

The vulnerability of the infoAction.php script used in the MediaWiki hypertext environment involves insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-75939: Improper Verification of Cryptographic Signature

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP Pretty Good Privacy release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulatin...

CVE-2026-94143: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out...

CVE-2026-94151: Missing Authentication for Critical Function

A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authentication. The attack may be launched...

CVE-2026-73511: Authentication Bypass by Alternate Name

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving...

CVE-2026-94145: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The manipulation of the argument name/autho...

CVE-2026-91921: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...

NPM vm2 Code Execution

The vulnerability of the NPM packet manager’s library vm2 is related to a breach in data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

Incus uploadDir S3 Arbitrary Command Execution

The vulnerability of the uploadDir function in the internal/server/storage/s3/local/multipart.go file of the container management system and the virtual machine manager Incus is related to improper external manipulation of the file name or path. Exploiting this vulnerability allows a remote...

TOTOLINK A3300R SetVpnPassCfg Command Execution

The vulnerability of the setVpnPassCfg function in TOTOLINK A3300R router microprogramming software is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...