EUVD-2026-68880

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

Linux Distros Unpatched Vulnerability : CVE-2026-19913

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Kaltura HTML5 player mwEmbed / html5lib contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in...

PT-2026-83704

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

PT-2026-83752

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any...

CVE-2025-63607

TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contactdisplay, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...

Important: postgresql15

Issue Overview: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the...

Important: postgresql

Issue Overview: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the...

Important: postgresql18

Issue Overview: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the...

Linux Distros Unpatched Vulnerability : CVE-2026-82854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope...

Amazon Linux 2023 : postgresql16, postgresql16-contrib, postgresql16-llvmjit (ALAS2023-2026-2078)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2078 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

CVE-2026-19873

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has countername set, its process method reads the repeat count from the named query string parameter, checks only that it is ...

Amazon Linux 2023 : postgresql15, postgresql15-contrib, postgresql15-llvmjit (ALAS2023-2026-2077)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2077 advisory. Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via craft...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2071)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2071 advisory. In the Linux kernel, the following vulnerability has been resolved: afunix: Drop all SCM attributes for SOCKMAP. CVE-2026-53005 In the Linux kernel, the following vulnerability has been...

Important: postgresql16

Issue Overview: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the...

C-MOR 6.0104 - Directory Traversal

Exploit Title: C-MOR 6.0104 - Directory Traversal Google Dork: N/A Date: 2026-07-23 Exploit Author: Fadi Kaakahji Alb Cyber Guards Vendor Homepage: https://www.c-mor.com Software Link: https://www.c-mor.com/ Version: Aufnahmen Kamera 5../../../../../../../../../../../../../../../../etc/passwd,...

CubeCart 6.7.4 - SQL

Exploit Title: CubeCart 6.7.4 - SQL Bypass in maintenance.index.inc.php Date: 2026-06-08 Exploit Author: Mikail Kocadağ Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE: CVE-2026-54646 Advisory / References...

The vulnerability of the setMacFilterRules() function in the MAC Filtering component of TOTOLINK A720R microprogrammed router software allows a intruder to trigger a service failure.

The vulnerability of the setMacFilterRules function in the MAC Filtering component of TOTOLINK A720R microprogrammed router software is related to the output of the operation being written outside of the buffer in memory when processing the desc parameter. Exploiting this vulnerability could allo...

C-MOR 6.0104 Cross Site Scripting

C-MOR Video Surveillance versions 6.0104 and below suffer from a cross site scripting vulnerability. Exploit Title: C-MOR 6.0104 - Cross-Site Scripting XSS Google Dork: N/A Date: 2026-07-23 Exploit Author: Samir Shamdin Alb Cyber Guards Vendor Homepage: https://www.c-mor.com Software Link:...

PT-2026-83981

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

PT-2026-83878

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbd cron process parameter without authentication. Attackers can predict the...