TOTOLINK CX-A3002RU - Remote Code Execution

An issue in TOTOLINK-CX-A3002RU V1.0.4-B20171106.1512 and TOTOLINK-CX-N150RT V2.1.6-B20171121.1002 and TOTOLINK-CX-N300RT V2.1.6-B20170724.1420 and TOTOLINK-CX-N300RT V2.1.8-B20171113.1408 and TOTOLINK-CX-N300RT V2.1.8-B20191010.1107 and TOTOLINK-CX-N302RE V2.0.2-B20170511.1523 allows a remote...

SUSE CVE-2026-54562

Cloudreve is a self-hosted file management and sharing system. Prior to 4.16.1, Cloudreve's remote download workflow accepts user-supplied URLs at POST /api/v4/workflow/download and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or...

Siemens Teamcenter Visualization 2412.x < 2412.0012 / 2506.x < 2506.0009 / 2512.x < 2512.2605 Privilege Escalation (SSA-288252)

The version of Siemens Teamcenter Visualization installed on the remote host is 2412.x prior to 2412.0012, 2506.x prior to 2506.0009, or 2512.x prior to 2512.2605. It is, therefore, affected by a vulnerability: - Untrusted search path in IAM Client SDK may allow an authenticated user to potential...

PT-2026-65881

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an...

PRTG Network Monitor - Local File Inclusion

PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges including administrator. A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local...

Integer Overflow or Wraparound

Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

CVE-2026-15968

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3...

EUVD-2026-46735

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware component: Patchset Assistant. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Dat...

CVE-2026-62480

...

CVE-2026-61036

...

CVE-2026-60656

...

CVE-2026-60549

...

CVE-2026-60312

CVE-2026-60312 affects Oracle WebLogic Server (Fusion Middleware Core). Affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via T3 or IIOP to compromise the server and potentially takeover the Oracle WebLogic ...

CVE-2026-60230

CVE-2026-60230 affects Oracle Coherence (Core) within Oracle Fusion Middleware. Affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence, potentially taking over the service....

CVE-2026-46988

The vulnerability affects Oracle Enterprise Manager Base Platform (Connector Framework) with affected versions 13.5 and 24.1. The root cause is not explicitly detailed in the provided documents, but the issue enables a high-privilege attacker who can reach the service over HTTPS to compromise the...

CVE-2026-46981

The CVE-2026-46981 entry affects Oracle Utilities Network Management System (Mobile component) with affected versions 2.5.0.1.0–2.5.0.1.17, 2.5.0.2.0–2.5.0.2.11, 2.6.0.1.0–2.6.0.1.12, 2.6.0.2.0–2.6.0.2.8, and 25.12.0.0.0–25.12.0.0.2. It is an unauthenticated, network-accessible vulnerability expl...

CVE-2026-52870 vulnerabilities

Vulnerabilities for packages: litellm, semgrep...

PT-2026-62635

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise FIN Cash Management version 9.2 Description An issue in the Cash Management component allows an unauthenticated attacker with network access via HTTP to compromise the system. Although the flaw is located within...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the handling of Proxy-Authorization headers by the cURL handlers and stream handler. An attacker can obtain proxy credentials by controlling the origin server and capturing the credentials sent...

CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...