PT-2026-104341

Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-104612: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/newannouncement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is...

Tenable Nessus < 10.12.5 Multiple Vulnerabilities (TNS-2026-26)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 10.12.5. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-26 advisory. - Nessus did not sufficiently verify the integrity of certain downloaded content...

PT-2026-104072

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer 0/admins/assessments/activities/btn functions.php?action=activity. The manipulation of the argument Title results in sql injection...

PT-2026-104443

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16 Description An authorization flaw exists in the UTMIncidentCommandWebsocket.processCommand function, which handles the '/command/hostname' STOMP destination. The system fails to perform role checks or apply a...

Unauthenticated Administrative REST API Access in Brocade ASCG before 3.5.0 (CVE-2026-85489)

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

CVE-2026-75937: Improper Neutralization of Special Elements used in an OS Command

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...

PT-2026-104328

A vulnerability was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file script/academic/core/new announcement.php of the component Announcement Module. The manipulation of the argument title/announcement results in cross site scripting. It is...

PT-2026-104329

A vulnerability was determined in CodeAstro Simple Pharmacy Management System 1.0. This vulnerability affects unknown code of the file /SimplePharmacy-PHP/product/view.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been public...

CVE-2026-104625: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in CodeAstro Simple Loan Management System 1.0. Impacted is an unknown function of the file /admin/index.php. Performing a manipulation of the argument gname results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2026-104053: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file adminreservefilter.php. Such manipulation of the argument filter leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly...

PT-2026-104065

A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin reservefilter.php. Such manipulation of the argument filter leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly...

PT-2026-104342

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-104606: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the...

PT-2026-104194

A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the...

PT-2026-104345

Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

PT-2026-104302

Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System LMS: through 2026-09-18...

MAL-2026-17453 Malicious code in gocommunity.io/orderedbtree (Go)

Part of the Graphalgo campaign. The module, first published around 2026-08-11, contains a second-stage remote access trojan in plaintext that runs automatically. The RAT collects system information, executes decrypted Go or JavaScript payloads, and polls two command-and-control channels every 3-1...

CVE-2026-104052: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file adminrejectcompleted.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly...

PT-2026-104064

Name of the Vulnerable Software and Affected Versions itsourcecode Pet Shop Management System version 1.0 Description A SQL injection issue exists in the admin reject completed.php file. This occurs when the ID argument is manipulated, allowing a remote attacker to execute unauthorized database...