CVE-2026-108829: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the file admin/modules.php of the component Module Configuration. The manipulation of the argument configuration results in sql injection. The attack may be launched remotely. The...

CVE-2026-21132: Undefined Security Weakness

Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability...

CVE-2026-108800: Cross-Site Request Forgery (CSRF)

A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2026-66086: Stack-based Buffer Overflow

In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed...

CVE-2026-108825: Improper Privilege Management

A vulnerability has been found in yangzongzhuan RuoYi up to 4.8.3. This affects the function checkRoleAllowed of the file /system/role/authDataScope. Such manipulation of the argument roleKey leads to improper privilege management. It is possible to launch the attack remotely. The exploit has bee...

CVE-2026-108820: Execution with Unnecessary Privileges

A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1. This issue affects the function memberagent.run in the library libs/agno/agno/team/defaulttools.py of the component Delegation Feature. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be...

CVE-2026-108816: Improper Control of Generation of Code

A vulnerability was found in agno-agi agno up to 3.0.6. Affected by this vulnerability is the function runpythoncode of the file python.py of the component PythonTools. The manipulation of the argument code results in code injection. The attack can be launched remotely. The exploit has been made...

CVE-2026-108812: Improper Authorization

A security vulnerability has been detected in SEMCMS up to 5.0. The impacted element is an unknown function of the file /admin/SEMCMSUser.php?Class=Deleted&CF=user. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit has been disclosed publicly...

CVE-2026-78356: Exposure of Sensitive System Information to an Unauthorized Control Sphere

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend rout...

CVE-2026-108808: Use of GET Request Method With Sensitive Query Strings

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...

CVE-2026-93582: Authentication Bypass by Spoofing

The HTTP Basic Authentication modules in OTRS Community Edition 6 and prior accept the authenticated username from either the REMOTEUSER or HTTPREMOTEUSER environment variable. In CGI and modperl based deployments, HTTP request headers may be mapped to corresponding HTTP environment variables. As...

CVE-2026-108790: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. This impacts the function TemplateController.save of the file /system/cms/template/save of the component Backend Template Editor. The manipulation results in path traversal. The attack may be...

CVE-2026-83536: Uncontrolled Resource Consumption

A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header...

CVE-2026-108920: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/userrecord.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launch...

CVE-2026-108916: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and...

CVE-2026-85967: Improper Neutralization of Input During Web Page Generation

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote attacker to execute script in the context of an authenticated user's browser session, which could result in unauthorized actions or disclosu...

CVE-2026-85963: Server-Side Request Forgery (SSRF)

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resultin...

CVE-2026-85969: Out-of-bounds Write

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of...

CVE-2026-85966: Exposure of Sensitive Information to an Unauthorized Actor

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorize...

CVE-2026-103537: Undefined Security Weakness

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and remote code execution. The checkTemplate validation restricts relative directory traversal sequences such as ../ but does not reject absolute paths, allowing an authorized user to...