Microsoft Purview eDiscovery Privilege Escalation

The vulnerability of the Microsoft Purview eDiscovery tool is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

Oracle Enterprise Asset Management Internal Operations Full Control

The vulnerability of the Internal Operations component of the Oracle Enterprise Asset Management application, a part of the Oracle E-Business Suite automation system for enterprise activities, is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker...

PT-2026-71936

A vulnerability was found in DTStack Taier 1.4.0. Affected by this vulnerability is the function Paths.ge of the file FileChunkController.java of the component Chunk-Check Endpoint. The manipulation of the argument Name results in path traversal. The attack may be launched remotely. The exploit h...

PT-2026-71970

Name of the Vulnerable Software and Affected Versions TOTOLINK A800R version 4.1.2cu.5137 B20200730 Description A remote attack is possible due to a stack-based buffer overflow in the setIpQosRules function within the /cgi-bin/cstecgi.cgi file of the firewall.so component. This issue occurs when...

PT-2026-72019

A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of the component logDetailCat Endpoint. This manipulation of the argument executorAddress causes path traversal. It is possible to initiate the...

PT-2026-71956

A vulnerability was determined in Tenda AC1206 15.03.06.23 multi TD01. This vulnerability affects the function set wl guest iplist of the file /goform/WifiGuestSet of the component httpd web management interface. This manipulation of the argument shareSpeed causes stack-based buffer overflow...

PT-2026-71958

A weakness has been identified in Tenda G0 up to 20260625. The affected element is the function addStaticRoute of the file /goform/module of the component httpd web management interface. Executing a manipulation of the argument staticRouteNet can lead to stack-based buffer overflow. The attack ma...

PT-2026-71939

Name of the Vulnerable Software and Affected Versions eyaushev swagger-testcase-mcp affected versions not specified Description A flaw in the fetch swagger component allows for remote server-side request forgery SSRF, a condition where an attacker can induce the server to make requests to an...

PT-2026-72013

Name of the Vulnerable Software and Affected Versions Tenda W20E version 15.11.0.61068 1546 841 CN TDC Description A security flaw in the QoS Rule Deletion component allows remote exploitation. A stack-based buffer overflow occurs when the qosIndex argument is manipulated within the formQOSRuleDe...

PT-2026-72041

Name of the Vulnerable Software and Affected Versions Webkul Bagisto versions prior to 2.4.5 Description An authorization bypass exists in the Backend Customer Detail Feature within the /admin/customers/view endpoint. A remote attacker can exploit this by manipulating the ID argument, allowing...

PT-2026-71937

Name of the Vulnerable Software and Affected Versions DTStack Taier version 1.4.0 Description A path traversal issue exists within the Cluster Creation component in the ClusterController.java file. The vulnerability occurs in the FileUtils.deleteDirectory function when the clusterName argument is...

PT-2026-71957

Name of the Vulnerable Software and Affected Versions Tenda G0 versions prior to 20260625 Description A stack-based buffer overflow exists in the httpd Web Management Interface. The issue occurs within the formSetPortMirror function located in the /goform/module file when the...

PT-2026-72034

Name of the Vulnerable Software and Affected Versions Webkul Bagisto versions prior to 2.4.5 Description An authorization bypass exists in the Admin Customer Impersonation Feature within the file /admin/customers/login-as-customer/. A remote attacker can exploit this by manipulating the ID...

CVE-2026-19758

A vulnerability was determined in dromara lamp-cloud up to 5.10.0. This issue affects some unknown processing of the file FileChunkController.java of the component chunk-check endpoint. Executing a manipulation of the argument Name can lead to path traversal. The attack can be launched remotely...

CVE-2026-19756

The vulnerability CVE-2026-19756 affects Dromara lamp-cloud (Code Generator) in DefGenProjectController.java, where improper handling of outputDir/parent/projectPrefix enables path traversal. The issue allows remote exploitation with a Proof-of-Concept exploit disclosed publicly; impact and speci...

CVE-2026-19751

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

CVE-2026-19749

A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to...

CVE-2026-19748 Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManagerParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument...

CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-19710 SourceCodester Simple Student Information System view_department.php sql injection

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/viewdepartment.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carri...