PT-2026-39541

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A remote denial of service issue exists in the SMF component. The flaw is located in the update authorized pcc rule and qos function within the /src/smf/npcf-handler.c file. An attacker can remotely...

PT-2026-39427

Name of the Vulnerable Software and Affected Versions Industrial Application Software IAS Canias ERP version 8.03 Description Improper authentication exists in the RMI Interface component. A remote attacker can manipulate the sessionId argument within the doAction function to bypass authenticatio...

PT-2026-39544

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A remote denial of service issue exists in the SMF component. The flaw is located in the update authorized pcc rule and qos function within the /src/smf/npcf-handler.c file. Manipulation of this...

PT-2026-39546

Name of the Vulnerable Software and Affected Versions Devs Palace ERP Online versions prior to 4.0.0 Description A cross-site scripting issue exists in the '/inventory/purchase save' file. This flaw allows a remote attacker to execute malicious scripts by manipulating an unknown functionality...

PT-2026-39439

Name of the Vulnerable Software and Affected Versions Devs Palace ERP Online versions prior to 4.0.0 Description A flaw in the file '/inventory/item-save' allows for remote cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites. Recommendations At the...

PT-2026-39543

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A remote denial of service issue exists in the SMF component. The problem is located in the smf n4 build qos flow to modify list function within the /src/smf/n4-build.c file. Recommendations Update t...

PT-2026-39428

Name of the Vulnerable Software and Affected Versions Industrial Application Software IAS Canias ERP version 8.03 Description A path traversal issue exists in the RMI Interface component. A remote attacker can exploit this by manipulating the m strSourceFileName argument within the...

PT-2026-39438

Name of the Vulnerable Software and Affected Versions Devs Palace ERP Online versions prior to 4.0.0 Description A cross-site scripting issue exists in the file '/inventory/customer-save'. This flaw allows a remote attacker to execute malicious scripts through the manipulation of an unspecified...

PT-2026-39456

Name of the Vulnerable Software and Affected Versions Wavlink NU516U1 version 240425 Description A flaw in the sys login1 function within the '/cgi-bin/login.cgi' endpoint allows for remote OS command injection. This occurs through the manipulation of the ipaddr argument, which could lead to full...

PT-2026-39442

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A remote denial of service can be triggered in the PCF component via the pcf sess set ipv6prefix function located in the /src/pcf/context.c file. This occurs through the manipulation of the...

PT-2026-39451

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A remote denial of service can be triggered via the 'delete' endpoint. The issue exists within the pcf npcf smpolicycontrol handle delete function located in the src/pcf/sm-sm.c file. Recommendations...

PT-2026-39545

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A remote manipulation in the SMF component can lead to a null pointer dereference, which occurs when a program attempts to read or write to a memory location using a null pointer. This issue...

PT-2026-39562

Name of the Vulnerable Software and Affected Versions Tenda AC6 version 15.03.06.49 multi TDE01 Description A flaw in the httpd component allows remote attackers to perform OS command injection. The issue exists within the fromSetWirelessRepeat function located in the '/goform/WifiExtraSet'...

PT-2026-39436

A weakness has been identified in Devs Palace ERP Online up to 4.0.0. The affected element is an unknown function of the file /inventory/purchase return save. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the...

PT-2026-39452

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.7.8 Description A security flaw allows for a remote denial of service through manipulation of the ogs pcc rule install flow from media function located in the /lib/proto/types.c library. Recommendations At the momen...

CVE-2026-8211

A vulnerability was detected in codelibs Fess up to 15.5.1. Affected by this issue is the function update of the file org/codelibs/fess/app/web/admin/design/AdminDesignAction.java of the component JSP File Handler. The manipulation of the argument content results in code injection. The attack may...

CVE-2026-8211 codelibs Fess JSP File AdminDesignAction.java update code injection

A vulnerability was detected in codelibs Fess up to 15.5.1. Affected by this issue is the function update of the file org/codelibs/fess/app/web/admin/design/AdminDesignAction.java of the component JSP File Handler. The manipulation of the argument content results in code injection. The attack may...

EUVD-2026-28939

A vulnerability was detected in JeecgBoot up to 3.9.1. The affected element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/CommonController.java of the component SVG File Handler. The manipulation results in cross site...

EUVD-2026-28919

A vulnerability was identified in Wavlink NU516U1 M16U1V240425. This affects the function wifiregion of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might ...

EUVD-2026-28920

A security flaw has been discovered in Wavlink NU516U1 M16U1V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument EncrypType/wlPass is directly passed by the attacker/so we can control the EncrypType/wlPass results in os...