CVE-2026-92213

a2ui-project a2ui (versions up to 0.10.6) is affected by an injection vulnerability in the Angular Renderer component. The vulnerable code is located in the function z.any within the file renderers/web_core/src/v0_9/schema/server-to-client.ts. By manipulating the primaryColor argument, a remote a...

PT-2026-93855

A vulnerability was found in Ruijie RG-EW3000GX EW 3.01B11P380. Affected by this issue is some unknown functionality of the file /etc/rg config/admin of the component user list note Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate...

CVE-2026-51990

The Sogou Input Method for Windows (versions prior to 16.3.0.3498 ) is vulnerable to a remote code execution (RCE) attack chain triggered by a specially crafted link. The attack begins when a user clicks a sgbiz: URI, causing the biz_helper.exe component to pass unvalidated command-line arguments...

PT-2026-93827

A vulnerability has been found in Ruijie RG-EW3000GX EW 3.01B11P380. Affected by this vulnerability is the function cc set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remot...

CVE-2026-76646: Uncontrolled Resource Consumption

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, ...

CVE-2026-27550: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the FieldShadowPassword class using operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93264

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

Linux Distros Unpatched Vulnerability : CVE-2026-91091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gfnodelistinsertchild of the file scenegraph/basescenegraph.c of the...

D-Link DGS-3420 XSS

The vulnerability of the System Information Settings Page component in D-Link DGS-3420 microprogramming devices is related to the lack of protective measures taken for the structure of the web page when processing the System Name parameter. Exploiting this vulnerability allows a malicious actor t...

RouterOS SSH Server Data Compromise

The vulnerability of the SSH server on the RouterOS operating system of MikroTik is related to the incorrect implementation of the sequence of actions to be performed. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the...

MediaWiki XSS

The vulnerability in the “resources/src/mediawiki.Api/index.js” script of the MediaWiki software, which is used for implementing the hypertext environment, is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor, operating...

Linux kernel br_multicast_leave_group Heap Buffer Overflow DoS

The vulnerability of the brmulticastleavegroup function in the net/bridge/brmulticast.c module, which is part of the Linux kernel’s networking functions, relates to the reutilization of previously freed memory. Exploiting this vulnerability could allow a remote attacker to compromise the...

MediaWiki apiUserrights.php Unauthorized Access

The vulnerability of the MediaWiki hypertext environment implementation, including the apiUserrights.php tool, is related to insufficient protection of operational data. Exploitation of this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

Linux IPv6 fib6_rule_suppress() Heap Buffer Overflow

The vulnerability of the fib6rulesuppress function in the net/ipv6/fib6rules.c module of the Linux operating system’s IPv6 kernel implementation is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentialit...

CVE-2026-92399: Heap-based Buffer Overflow

A vulnerability was determined in GPAC 26.07.0. This affects the function rmtclienthandlewsframe of the file src/utils/rmtws.c of the component WebSocket Handler. Executing a manipulation of the argument payloadsize can lead to heap-based buffer overflow. It is possible to launch the attack...

CVE-2026-76460: Incorrect Use of Privileged APIs

A vulnerability in an API of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request ...

CVE-2026-92749: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-76451: SQL Injection: Hibernate

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76449: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76447: Missing Authentication for Critical Function

A vulnerability in the Online Certificate Status Protocol OCSP responder of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to cause an administrative reload of the OCSP responder certificate and key material. This vulnerability is due to missing authentication on a...