OpenTofu DoS

The vulnerability of the OpenTofu infrastructure management tool is related to the presence of vulnerabilities in the borrowed components. Exploiting these vulnerabilities can allow a malicious actor, operating remotely, to cause service failures...

LibreNMS XSS

The vulnerability of the LibreNMS network monitoring system is related to deficiencies in the blocking procedures. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

ROS-20260924-73-0076

The vulnerability of the hcievent component in the Linux operating system’s kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

ROS-20260924-73-0066

The vulnerability of the i40e component in the Linux operating system is related to the allocation of unlimited memory. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

EUVD-2026-86018

An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components...

PT-2026-97826

Name of the Vulnerable Software and Affected Versions geelen mcp-remote versions 0.1.18 through 0.1.38 Description A flaw in the SSE Server-Sent Events transport eventSourceInit fetch wrapper located in src/lib/utils.ts allows a remote attacker to obtain sensitive information. Recommendations...

CVE-2026-97231: Missing Authentication for Critical Function

A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Socket.IO Connect Interface. The manipulation results in missing authentication. It is possible to launch the attack remotely. The exploit has been made public a...

CVE-2026-87739: Authorization Bypass Through User-Controlled Key

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...

CVE-2026-52001

The software geelen mcp-remote versions 0.1.18 through 0.1.38 contains a vulnerability that allows a remote attacker to obtain sensitive information . The root cause is located in the SSE transport eventSourceInit fetch wrapper within the file src/lib/utils.ts. No specific exploit details, in-the...

PT-2026-98305

Three critical unauthenticated CVEs in ViewSonic vCast CVE-2026-82987, CVE-2026-82988, CVE-2026-82989 allow a remote attacker to chain screen exfiltration with arbitrary APK installation for full device compromise. These are Android-based ViewBoard smartboards, heavily deployed in enterprise and...

CVE-2026-96773: URL Redirection to Untrusted Site

A weakness has been identified in Intelliants Subrion CMS up to 4.2.1. This vulnerability affects the function iaUsers::authorize of the file front/login.php of the component Login Page. This manipulation of the argument $SERVER'HTTPREFERER' causes open redirect. The attack is possible to be...

CVE-2026-97324: Improper Authorization

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback...

CVE-2026-97323: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.java of the component File Upload. Executing a manipulation...

CVE-2026-97321: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yudao-module-report/src/main/java/cn/iocoder/yudao/module/report/service/goview/GoViewDataServiceImpl.java of the component GoVie...

CVE-2026-97368: Authorization Bypass Through User-Controlled Key

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-info Endpoint. This manipulation of th...

CVE-2026-97366: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function openDevTools of the file electron/window.js of the component Open in Editor Handler. The manipulation of the argument host results in os command injection. It is possible to...

CVE-2026-97326: Server-Side Request Forgery (SSRF)

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this issue is some unknown functionality of the file chat-server/src/main/java/cn/sinjinsong/chat/server/ChatServer.java of the component chat-server. This manipulation causes...

CVE-2026-97325: URL Redirection to Untrusted Site

A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability is the function validOAuthClientFromCache of the file yudao-module-system/src/main/java/cn/iocoder/yudao/module/system/service/oauth2/OAuth2ClientServiceImpl.java of the compone...

CVE-2026-97179: Exposure of Sensitive Information to an Unauthorized Actor

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/xbasecoreproject/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the component Cipher Connection Handler. Such manipulation of t...

CVE-2026-96810: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in huanzi-qch base-admin up to 52816b760cd53244989fd664bbb2b3d4edbfdbf1. This issue affects the function Save of the file base-admin-master\src\main\java\cn\huanzi\qch\baseadmin\common\controller\CommonController.java of the component Add User Handler. The...