CVE-2026-27549: Improper Neutralization of Special Elements used in an OS Command

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/doupload endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-20284: Improper Neutralization of Special Elements in Data Query Logic

A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. This vulnerability is due to insufficient validation of user-supplied input in REST API calls. An attacker could exploit this vulnerability by sending crafted input to ...

CVE-2026-92214: Improper Neutralization of Input During Web Page Generation

A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of the component a2a-chat-canvas. Executing a manipulation can lead to cross site...

CVE-2026-92221: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generateindexpasien of the file application/models/appglobaladminmodel.php. Executing a manipulation of the argument cari can lead to sql...

PT-2026-93251

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agent sdks/python/a2ui agent/src/a2ui/extensions/file resolve/file resolver.py of the component FileResolver. The manipulation leads to server-side request forger...

PT-2026-93228

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web core/src/v0 9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible...

CVE-2026-92213: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/webcore/src/v09/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor results in injection. The attack is possible t...

EUVD-2026-80932

An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...

PT-2026-93695

Name of the Vulnerable Software and Affected Versions WNC T-Mobile 5G Box IDU versions prior to 1.1.0.651412 Description Improper access control allows a remote attacker to access the 'wnc maccheck.cgi' endpoint without authentication. This enables the retrieval of sensitive configuration data,...

CVE-2026-27565: Improper Neutralization of Special Elements used in an OS Command

An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...

CVE-2026-76425: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the APIs of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks against the backend database. This vulnerability is due to insufficient validation of certain parameters that are concatenated directly into an SQL query. An attacker could...

PT-2026-93786

Name of the Vulnerable Software and Affected Versions code-projects Matrimonial System version 1.0 Description An SQL injection issue exists in the Regular Search component within the '/search.php' endpoint. A remote attacker can exploit this by manipulating the sex, mothertongue, maritialstatus,...

PT-2026-93975

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Cisco Secure FTD Software affected versions not specified Description An issue exists in the sftunnel inter-device communication protocol during the TLS connection setup. An...

PT-2026-93964

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An unauthenticated remote attacker can perform SQL injection attacks on an affected device due to improper validation of user-supplied input. By sending a crafted request, an attacker could...

CVE-2026-76413: Improper Restriction of Security Token Assignment

A vulnerability in Cisco Adaptive Security Device Manager ASDM single sign-on SSO handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An...

CVE-2026-92405: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /index.php. Such manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2026-92385: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/updatecategory.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit h...

PT-2026-93995

Name of the Vulnerable Software and Affected Versions Cisco ThousandEyes Virtual Appliance affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker to perform operating system command injection. This occurs because the...

CVE-2026-73173: Missing Authentication for Critical Function

Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to invoke critical device-management functions, including...

CVE-2026-92184: Server-Side Request Forgery (SSRF)

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/aguistrands/utils.py of the component Multimodal Content. The manipulation of the argument Value results in server-side request forger...