CVE-2026-18592

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

CVE-2026-18583

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mmsmapping/mmsmapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds read. The attack can be initiated...

EUVD-2026-52167

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENTLENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

CVE-2026-18588

The CVE-2026-18588 affects the Wavlink WL-NU516U1 (708c073-mt7628) device, with a stack-based buffer overflow in nas.cgi caused by manipulation of CONTENT_LENGTH. This allows remote exploitation and could impact confidentiality, integrity, and availability. A fixed version has been released by th...

CVE-2026-18588 Wavlink WL-NU516U1 nas.cgi fgets stack-based overflow

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENTLENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

CVE-2026-18587 Wavlink WL-NU516U1 Config Import os command injection

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...

CVE-2026-18585

The CVE describes a heap-based overflow in GL.iNet APPS-NAS NAS module function nas-web.get_file_list, affecting GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 (through 20260707). The vulnerability arises from manipulation of input to nas-web.get...

CVE-2026-18585 GL.iNet MT2500 APPS-NAS nas-web.get_file_list heap-based overflow

A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.getfilelist of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer...

CVE-2026-20464

A vulnerability exists in the hevc decoder where an integer overflow can result in an out-of-bounds write . If an attacker has already obtained System privilege , this flaw could lead to a remote escalation of privilege . Exploitation does not require user interaction. Remediation is available vi...

Vulnerability of .NET, Microsoft .NET Framework, and Microsoft Visual Studio software platforms, which allows for unlimited distribution of resources, enabling attackers to cause service failures.

The vulnerabilities of .NET software platforms, the Microsoft .NET Framework, and Microsoft Visual Studio are related to the unlimited distribution of resources. Exploiting these vulnerabilities can allow a malicious actor to cause service failures remotely...

PT-2026-67397

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check config of the file /cgi-bin/glc of the component ovpn-client.so Native Plugin. Performing a manipulation of the argument filename results in command injection. Remote exploitation of the attack...

PT-2026-67484

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code executor/jinja2/jinja2 transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used...

PT-2026-67483

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component PreAuthorize Handler. The manipulation leads to authorization...

CVE-2026-18588: Stack-based Buffer Overflow

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENTLENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

PT-2026-67144

A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get file list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer...

PT-2026-67146

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENT LENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

PT-2026-67482

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set peer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument public key leads to command injection. Remote exploitation of the attack is...

CVE-2026-18647: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

CVE-2026-18452 Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials

DMS+ Non-Mobile developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices...

SUSE CVE-2026-9299

A flaw has been found in omec-project amf up to 2.1.1. Affected by this issue is the function PDUSessionResourceModifyIndication of the file /go/src/amf/ngap/handler.go. This manipulation causes memory corruption. Remote exploitation of the attack is possible. The exploit has been published and m...