CVE-2026-92213 a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...

PT-2026-93855

A vulnerability was found in Ruijie RG-EW3000GX EW 3.01B11P380. Affected by this issue is some unknown functionality of the file /etc/rg config/admin of the component user list note Module. Performing a manipulation of the argument Name results in os command injection. It is possible to initiate...

Linux IPv6 fib6_rule_suppress() Heap Buffer Overflow

The vulnerability of the fib6rulesuppress function in the net/ipv6/fib6rules.c module of the Linux operating system’s IPv6 kernel implementation is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow a remote attacker to compromise the confidentialit...

RouterOS SSH Server Data Compromise

The vulnerability of the SSH server on the RouterOS operating system of MikroTik is related to the incorrect implementation of the sequence of actions to be performed. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the...

D-Link DGS-3420 XSS

The vulnerability of the System Information Settings Page component in D-Link DGS-3420 microprogramming devices is related to the lack of protective measures taken for the structure of the web page when processing the System Name parameter. Exploiting this vulnerability allows a malicious actor t...

MediaWiki apiUserrights.php Unauthorized Access

The vulnerability of the MediaWiki hypertext environment implementation, including the apiUserrights.php tool, is related to insufficient protection of operational data. Exploitation of this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

MediaWiki XSS

The vulnerability in the “resources/src/mediawiki.Api/index.js” script of the MediaWiki software, which is used for implementing the hypertext environment, is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor, operating...

CVE-2026-51990

The Sogou Input Method for Windows (versions prior to 16.3.0.3498 ) is vulnerable to a remote code execution (RCE) attack chain triggered by a specially crafted link. The attack begins when a user clicks a sgbiz: URI, causing the biz_helper.exe component to pass unvalidated command-line arguments...

PT-2026-93827

A vulnerability has been found in Ruijie RG-EW3000GX EW 3.01B11P380. Affected by this vulnerability is the function cc set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remot...

CVE-2026-76646: Uncontrolled Resource Consumption

A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, ...

CVE-2026-27550: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the FieldShadowPassword class using operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93264

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been...

PT-2026-94011

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Cisco ISE-PIC affected versions not specified Description An internal service in the affected software lacks proper authentication on the Policy Runtime Repository Table PRRT service. This allows an...

PT-2026-93965

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Adaptive Security Appliance ASA Software affected versions not specified Cisco Secure Firewall Threat Defense FTD Software affected versions not specified Description A logic error in the DNS over TCP implementation occur...

CVE-2026-89028: Heap-based Buffer Overflow

MikroTik RouterOS before 7.24 contains a heap memory corruption vulnerability in the userspace SMB daemon that allows remote attackers to corrupt adjacent heap memory by supplying a crafted uniPwdLen value in the SMB1 SessionSetupAndX handler. An attacker can send a malformed SMB1 request with a...

CVE-2026-92399: Heap-based Buffer Overflow

A vulnerability was determined in GPAC 26.07.0. This affects the function rmtclienthandlewsframe of the file src/utils/rmtws.c of the component WebSocket Handler. Executing a manipulation of the argument payloadsize can lead to heap-based buffer overflow. It is possible to launch the attack...

CVE-2026-76460: Incorrect Use of Privileged APIs

A vulnerability in an API of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request ...

CVE-2026-92749: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to reconstruct the key offline. Unauthenticated remote attackers who can bound the install timestamp can regenerate the secret and forge valid administrator...

CVE-2026-76451: SQL Injection: Hibernate

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...

CVE-2026-76449: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct an SQL or HQL injection attack on an affected device. This vulnerability is due to insufficient validation of user-supplied input to the...