PT-2026-84285

Name of the Vulnerable Software and Affected Versions Cleo Harmony versions prior to 5.8.1.11 Description An issue exists in the SAML Authentication component where manipulation of the Email argument within the LocalUserUtil.getNativeUserByAssertions function allows for improper authentication...

CVE-2026-51761

Incorrect access control in the updateLanIp function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to refresh the LAN address state via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69194

Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to insert or replace mesh neighbor records via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69210

Incorrect access control in the guestwifisync function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the csbroker component...

PT-2026-84242

Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to kick or clean stale mesh information/state and trigger regeneration of mesh metadata via sending a crafted MQTT message to the cs broker component...

PT-2026-84261

Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degrade availability by returning a referral URL whose port component is a very long run of digits. eldap:parse port/2 passes the port substring straight to list t...

PT-2026-84243

Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs broker component...

PT-2026-84375

Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid...

EUVD-2026-69409

Buffer Overflow vulnerability in Ffmpeg v.7.0 and after allows an attacker to cause a denial of service via the libavformat/iamfwriter.c component...

PT-2026-84564

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in the FileSystem component allows a remote attacker to execute arbitrary code outside the sandbox. This is achieved by leveraging social engineering to entice a...

PT-2026-84558

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description An information leak exists in the MediaCapture component. A remote attacker can potentially leak sensitive information by inducing a user to visit a crafted HTML page. Recommendations...

PT-2026-84544

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Missing authorization in the FileSystem component allows a remote attacker to obtain sensitive information. This occurs when an attacker has already compromised the renderer process and...

PT-2026-84240

Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the informSyncUpgfw function allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves. This is achieved by sending a crafted...

PT-2026-84119

Name of the Vulnerable Software and Affected Versions Cobham SATCOM VSAT7090 Maritime Satellite Router versions prior to 20260704 Description Command injection is possible via remote attack in the JSON Parsing component. The issue exists within the c set reports decode function of the...

PT-2026-84073

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the...

PT-2026-84559

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description A use after free issue in the Browser component allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox. This is achieved...

PT-2026-84556

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in the TabStrip component allows a remote attacker to potentially execute arbitrary code outside the sandbox. This requires the attacker to have already...

PT-2026-84358

Name of the Vulnerable Software and Affected Versions cleverange auth version 0.1.10 Description A remote attacker can cause a denial of service through the account verification function located in the accounts/models.py component. Recommendations At the moment, there is no information about a...

The vulnerability of the FilteredObjectInputStream component in the Apache Log4j2 logging library allows a hacker to execute arbitrary code.

The vulnerability of the FilteredObjectInputStream component in the Apache Log4j2 logging library is related to deserialization mechanism flaws. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2026-62735

CVE-2026-62735 Information This vulnerability was originally discovered by Siyeon Wi. I reproduced the vulnerability independently for educational and case-study purposes. The vulnerability was also demonstrated at Pwn2Own Berlin 2026. References: TrendAI Zero Day Initiative status TrendAI Zero D...