PT-2026-81977

The WooCommerce Lottery plugin for WordPress is vulnerable to Time-Based SQL Injection via 'orderby' and 'order' GET Parameters in all versions up to, and including, 2.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Thi...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104552)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104552 advisory. In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function...

CVE-2020-15878

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajaxtable.php API endpoint...

CVE-2026-68000

The front-end interface /cms/category/list of MCMS =6.2.0 is vulnerable to SQL injection. The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker $size without being parameterized and bound. The built-in SqlInjectionUtil employs regular expression blacklist...

CVE-2026-75364

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the updateinterfacepng SET handler in /usr/bin/webmgnt fails to sanitize the displayname parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...

PT-2026-82196

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fbdev component where the mode string function uses snprintf, which may return a value exceeding the remaining buffer space. The show modes function accumulates th...

PT-2026-82281

Name of the Vulnerable Software and Affected Versions ZoneMinder affected versions not specified Description An authenticated OS command injection issue exists in the event export functionality. An authenticated user with View Events permission can execute arbitrary operating system commands on t...

CVE-2020-15878

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the address parameter in the /ajaxtable.php API endpoint...

PT-2026-82078

The Grav API plugin getgrav/grav-plugin-api before 1.0.18 does not apply the API-key scope cap in the injectSecurityTab function of BlueprintController when deciding whether a page's security/permissions blueprint section is editable. Because the function performs raw isSuperAdmin/hasPermission...

PT-2026-82335

Name of the Vulnerable Software and Affected Versions super-diamond-server versions prior to 1.3.4 Description The front-end interface '/superdiamond/preview/projectCode/module/type' is susceptible to SQL injection. This occurs because the module parameter is directly concatenated into a SQL IN...

Linux Distros Unpatched Vulnerability : CVE-2026-80580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: bound mode sysfs output to the sysfs buffer modestring uses snprintf which can return a value larger than the remaining buffer space. showmodes accumulat...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031330 advisory. The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page...

CVE-2026-75330

The front-end interface /superdiamond/preview/projectCode/module/type of super-diamond-server = 1.3.3 is vulnerable to SQL injection. The module parameter is directly concatenated into the SQL IN clause through StringUtils.split and string concatenation without being parameterized and bound...

EUVD-2026-66745

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concatenated to the ProcessBuilder...

PT-2026-82303

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX 2024-01-30 build, the update interface png SET handler in /usr/bin/webmgnt fails to sanitize the display name parameter. User-controlled input is concatenated via sprintf into the unquoted shell command /etc/rrd/graphinterface %s %s and executed by...

CVE-2026-75364

Comfast CF-N1-S (firmware 2.6.0.1) and CF-WR630AX (2024-01-30 build) contain a command injection vulnerability in the update_interface_png SET handler within /usr/bin/webmgnt. The unsanitized display_name parameter is concatenated via sprintf() into the unquoted shell command /etc/rrd/graphinterf...

CVE-2020-15876

LibreNMS 1.65 is affected by a SQL injection in the sort parameter of the /ajax_table.php API endpoint, spanning 24 files in includes/html/table . A remote authenticated attacker with normal privileges can extract the entire LibreNMS database. The vulnerability carries a CVSS 3.1 score of 8.8 (HI...

A Self-Evolving Multi-Agent Framework Defense against LLM Jailbreak Attacks

Large language models LLMs remain vulnerable to jailbreak attacks that exploit techniques such as role-playing, obfuscation, code transformation, and multi-step indirection to elicit harmful outputs. As jailbreak strategies keep emerging, defenses have proliferated in an ongoing cat-and-mouse gam...

CVE-2020-15876

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098781)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098781 advisory. In the Linux kernel, the following vulnerability has been resolved: be2net: Fix NULL pointer dereference in becmdgetmacfromlist When the parameter pmacidvalid argume...