UTT HiPER 810G strcpy() Code Execution

The vulnerability of the strcpy function in the microprogrammed routing software UTT HiPER 810G is related to the use of memory after deallocation when processing the loadBalanceNameOld parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Totolink A8000R Router setLanguageCfg XSS

The vulnerability of the setLanguageCfg /cgi-bin/cstecgi.cgi function in the Totolink A8000R router’s microprogramming software is related to the lack of authentication for the critical langType parameter during processing. Exploiting this vulnerability allows an attacker to bypass security...

TP-Link Archer VX1800v CRLF Injection Privilege Escalation

The vulnerability of TP-Link Archer VX1800v V1 microprogramming software is related to the lack of measures taken to eliminate CRLF sequences. Exploiting this vulnerability allows a remote attacker to alter account roles and gain administrator privileges...

Totolink A8000RU Router Command Execution

The vulnerability of the setWiFiBasicCfg function in Totolink A8000RU router microprogramming software is related to the lack of measures taken for data cleaning at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system commands using a...

CVE-2026-101145: Improper Neutralization of Special Elements used in an LDAP Query

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The...

PT-2026-102345

A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/userAddAction.do of the component User Management. Such manipulation of the argument Username leads to ldap injection. The attack can be executed remotely. The...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.27 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.27...

WordPress WebFacing Email Accounts for cPanel plugin 5.3-5.3.6 - Unauthenticated LFI vulnerability

Unauthenticated LFI vulnerability discovered by nobody in WordPress Plugin WebFacing Email Accounts for cPanel versions 5.3-5.3.6...

WordPress UpdraftPlus: WP Backup & Migration Plugin plugin 1.23.8-1.26.7 - Subscriber+ Remote Storage Credential Disclosure vulnerability

Subscriber+ Remote Storage Credential Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin UpdraftPlus versions 1.23.8-1.26.7...

PT-2026-99719

Name of the Vulnerable Software and Affected Versions Flatpak affected versions not specified Description On multi-user systems, a local user with an active session can downgrade a system-wide application to an older version. This is achieved by removing the application's remote reference using t...

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service MaaS platform called Lunex. The new findings come from Ontinue, which described the activity as a four-stage attack chain aime...

CVE-2026-63431 Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)

Horilla is an HR and CRM software. In 1.5.0-85 and earlier, payroll/views/componentviews.py does not consistently authorize access in allowancesdeductionstab, viewsingleallowance, and viewsinglededuction before loading records selected by empid, allowanceid, or deductionid. An authenticated...

EUVD-2026-87288

GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to...

SectopRAT Abuses Legitimate Audio Software Files to Steal PC Data

FortiGuard found SectopRAT hidden in modified audio software files, using staged loading to steal browser data and remotely control infected Windows PCs...

WordPress Elementor Website Builder plugin 4.3.0-4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Sakri Koskimies in WordPress Plugin Elementor Website Builder versions 4.3.0-4.3.1...

Malicious code in chromatitle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793cf7eb2b4de9c41e229fc89c393e38f05141991762f69f310e1397fa464f9c chromatitle advertises itself as an ANSI color/title formatting library but its main entry src/index.js unconditionally calls bootstrap at top level,...

EUVD-2026-86500

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlled object containing a proto property to modify the prototype of an object created during serialization in clonePlainJSObject in...

Dahua IPC/VTH/VTO - Authentication Bypass

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. id: CVE-2021-33045 info: name: Dahua IPC/VTH/VTO - Authentication Bypass author: phantomowl severity:...

OESA-2026-4018 coredns security update

CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins. Security Fixes: An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a...

Resource-Optimized and Energy-Aware Agentic AI Framework Anchored on Blockchain for Secure Software Supply Chains

This paper proposes a blockchain-backed agentic security framework designed to safeguard the complete software development lifecycle SDLC while also securing the agentic AI components responsible for monitoring it. The framework coordinates a set of specialised security agents, covering source...