PT-2026-82475

Name of the Vulnerable Software and Affected Versions CodeMeter Runtime affected versions not specified Description The cmu.exe utility creates a predictable temporary file in the C:CM-Stick directory when the --create-io flag is used with the --file parameter. The application fails to properly...

PT-2026-82615

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description An issue exists where the software fails to validate the memory cost parameter within identity file protection blocks. This allows an attacker with write access to local identity stores to...

PT-2026-82517

An issue was discovered in luci-app-https-dns-proxy on OpenWrt PR 15 2026-01-17. The setInitAction function in /usr/libexec/rpcd/luci.https-dns-proxy allows authenticated users to execute arbitrary shell commands via shell metacharacters in the name parameter...

PT-2026-82498

A vulnerability in the endpoint ‘/ws/apitribuna/ultimosVideos’ where the limit videos parameter is directly concatenated into a MariaDB SQL query without proper sanitization or parameterization. By injecting SQL syntax into this parameter, a remote attacker can cause SQL syntax errors and...

CVE-2026-37064

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

VulnCheck KEV: CVE-2026-61511

vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5TemplateRuntime::runMaths method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenavpagenumber...

CVE-2026-37004

BerriAI litellm (

EUVD-2026-67271

BerriAI litellm =1.82.4 is vulnerable to Server-Side Template Injection SSTI, which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotpromptcontent parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment...

TencentOS Server 3: go-toolset:rhel8 (TSSA-2026:0888)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0888 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

PT-2026-82621

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.4 Description Path traversal occurs in model-artifact APIs when pathsec is enabled. The issue arises from the use of raw file operations on caller-controlled paths, which allows bypassing pathsec enforcement. This...

Linux Distros Unpatched Vulnerability : CVE-2026-81726

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on...

...[ More ]

Chronicle Wire's MethodReader implements message dispatch by dynamically mapping serialized wire events to Java handler methods. During initialization, the framework discovers public methods exposed by the registered handler interfaces and registers those methods as callable wire events. When a...

CVE-2026-75417

A SQL injection vulnerability in YzmCMS 7.5 exists in the get_arrchildid() function within application/admin/controller/category.class.php. The user-controlled parentid parameter is concatenated directly into a FIND_IN_SET() SQL clause without proper sanitization, enabling an authenticated admini...

PT-2026-82447

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request uri parameter. An attacker can craft a request containing an invalid request uri paired with an unvalidated redirect uri, which can result in an open redirect...

PT-2026-82496

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id ambito parameter. Unsanitized input is directly incorporated into a MariaDB query, allowing attackers to inject SQL syntax that interrupts the query's execution. The vulnerability results in detailed database...

EUVD-2026-67266

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'username' parameter to test if the user exists...

PT-2026-82667

User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'user name' parameter to test if the user exists...

TencentOS Server 3: osbuild-composer (TSSA-2026:0911)

"The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0911 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilitie...

PT-2026-82685

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated...

CVE-2026-36102

Bluewave Labs Checkmate versions up to and including 3.3.0 are affected by a privilege escalation vulnerability in the inviteController.js component. A remote authenticated administrator can exploit the role parameter at the /api/v1/invite endpoint to escalate their privileges to superadmin . The...