Web-Check < 2.0.1 Screenshot API - OS Command Injection

Lissy93/web-check contains a command injection caused by unsanitized user input in the screenshot API, letting attackers execute arbitrary system commands, exploit requires sending crafted url parameters. id: CVE-2025-32778 info: name: Web-Check 2.0.1 Screenshot API - OS Command Injection author:...

CVE-2026-0297

A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle MitM attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges SYSTEM privileges on Windows, and root privileges on...

CVE-2026-0298

An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider PLAP component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle MitM attacker to execute arbitrary code with SYSTEM privileges on an affected client. The...

CVE-2026-0299

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

CVE-2026-0299 GlobalProtect App: Local Privilege Escalation Vulnerabilities

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

CVE-2026-0299 GlobalProtect App: Local Privilege Escalation Vulnerabilities

Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to escalate their privileges to NT AUTHORITY\SYSTEM on Windows, and root on macOS and Linux. This enables a non-administrative user to execute arbitrary commands with administrative...

EUVD-2026-57712

An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider PLAP component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle MitM attacker to execute arbitrary code with SYSTEM privileges on an affected client. The...

CVE-2026-0298 GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)

An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider PLAP component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle MitM attacker to execute arbitrary code with SYSTEM privileges on an affected client. The...

CVE-2026-0298 GlobalProtect App: Code Execution Vulnerability in Windows Pre-Logon Access Provider (PLAP)

An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider PLAP component of the Palo Alto Networks GlobalProtect™ app on Windows devices which enables a man-in-the-middle MitM attacker to execute arbitrary code with SYSTEM privileges on an affected client. The...

CVE-2026-0298

The CVE-2026-0298 issue affects the Windows GlobalProtect app’s Pre-Logon Access Provider (PLAP). The vulnerability arises from improper input validation in PLAP, enabling a man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges on Windows clients. The vulnerability does not ...

CVE-2026-46688

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...

PT-2026-71674

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view department.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be...

PT-2026-71560

Unauthenticated Broken Authentication in Salon booking system = 10.30.26 versions...

PT-2026-71903

OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...

PT-2026-71518

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-53785

Unknown description...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46382

MRBS prior to v1.12.2 is vulnerable to server-side request forgery during import, where a user-supplied private/local URI can be fetched without validation. The fixed version is v1.12.2; no workaround is listed in the provided documents. Remediation: upgrade to v1.12.2 or newer as stated in the s...

CVE-2026-46688 Meeting Room Booking System has an unauthenticated open redirect

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...

CVE-2026-46688

CVE-2026-46688 affects the Meeting Room Booking System (MRBS) prior to version 1.12.2, where an unauthenticated request can trigger a redirect to a caller-controlled URL. This open redirect could lead users to attacker-specified sites, including a spoofed MRBS login page. The issue is fixed in MR...