PT-2026-45815

Name of the Vulnerable Software and Affected Versions Dräger Atlan A350 versions 1.00 through 1.01 Description Improper input handling allows attackers to cause a denial of service by sending specifically crafted non-Medibus-compliant data through the Medibus interface. Transmitting malformed dat...

PT-2026-45861

Name of the Vulnerable Software and Affected Versions Dräger Protector Software versions prior to 6.4.2 Description Insecure file system permissions allow local attackers to execute arbitrary code with elevated privileges. This is achieved by replacing binaries or loaded modules on the host syste...

PT-2026-45860

Name of the Vulnerable Software and Affected Versions Dräger Protector Software versions prior to 6.4.2 Description Insecure file system permissions allow local attackers to execute arbitrary code with elevated privileges. This is achieved by replacing binaries or loaded modules on the host syste...

PT-2026-45864

Name of the Vulnerable Software and Affected Versions Dräger Zeus Infinity Empowered Zeus IE affected versions not specified Dräger Zeus RS C500 affected versions not specified Description A local security issue exists in anesthesia workstations that allows unauthorized individuals with physical...

PT-2026-45811

Name of the Vulnerable Software and Affected Versions Dräger SC Monitoring devices SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL affected versions not specified Description These devices contain hard-coded plaintext credentials in the source code and are susceptible to a denial-of-service...

PT-2026-45880

Name of the Vulnerable Software and Affected Versions GLPI versions 11.0.0 through 11.0.6 Description An issue exists where a technician can store a Cross-Site Scripting XSS payload within ITIL costs. XSS is a type of security flaw that allows an attacker to inject malicious scripts into web page...

PT-2026-45728

Name of the Vulnerable Software and Affected Versions Confidant versions prior to 1.5 Description Improper control of filenames for include or require statements in the PHP program allows for Local File Inclusion. This occurs when the application fails to properly validate the file paths used in...

CVE-2026-10290

A weakness has been identified in code-projects Hotel and Tourism Reservation System 1.0. The affected element is an unknown function of the file tour.php of the component GET Parameter Handler. Executing a manipulation of the argument tour can lead to sql injection. The attack can be launched...

CVE-2026-48811

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an internal note private thread from any conversation, even after that user's access to the mailbox containing the conversation has been...

EUVD-2026-33842

Kiteworks is a private data network PDN. Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global...

OPENSUSE-SU-2026:20858-1 Security update for hplip

This update for hplip fixes the following issues: Changes in hplip: - Update to HPLIP 3.26.4 CVE-2026-8631: Fixed privileges escalation and/or arbitrary code execution via an integer overflow in the hpcups processing path bsc1266023 CVE-2026-8632: Fixed privileges escalation and/or arbitrary code...

@etherna/sdk-js (>=2.0.1 <=2.0.3), @eui/deps-base (>=21.0.0-alpha.33 <=23.0.0-alpha.1) +14 more potentially affected by CVE-2026-47429 via @vitest/ui (>=4.0.14 <=4.0.7)

@vitest/ui NPM version =4.0.14, =2.0.1, =21.0.0-alpha.33, =1.3.0, =0.3.5, =0.3.0, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.4.2 and more Source cves: CVE-2026-47429 Source advisory: SNYK:JS-VITESTUI-17120328...

EUVD-2026-33633

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/. This manipulation causes file and directory information exposure. The attack can be initiated remotely. The exploit has been published and may be used...

CVE-2026-10254 SourceCodester Pet Grooming Management Software admin file information disclosure

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/. This manipulation causes file and directory information exposure. The attack can be initiated remotely. The exploit has been published and may be used...

CVE-2026-10254 SourceCodester Pet Grooming Management Software admin file information disclosure

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/. This manipulation causes file and directory information exposure. The attack can be initiated remotely. The exploit has been published and may be used...

CVE-2026-10254

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/. This manipulation causes file and directory information exposure. The attack can be initiated remotely. The exploit has been published and may be used...

A week in security (May 25 &#8211; May 31)

Last week on Malwarebytes Labs: Payment apps are watching what you say Lock and Code S07E11 Scammers pretending to be Microsoft had help from US executives 700+ education and tech websites hijacked in huge ClickFix malware campaign Fake software on GitHub and SourceForge distribute Deno RAT Fake...

MOVEit Transfer - Remote Code Execution

In Progress MOVEit Transfer before 2021.0.6 13.0.6, 2021.1.4 13.1.4, 2022.0.4 14.0.4, 2022.1.5 14.1.5, and 2023.0.1 15.0.1, a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database...

Hitachi Pentaho Business Analytics Server - Remote Code Execution

Hitachi Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x, is susceptible to remote code execution via server-side template injection. Certain web services can set property values which contain Spring templates that are interpreted downstream, thereby...

PAN-OS Management Web Interface - Authentication Bypass

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...