CVE-2026-87680: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters...

PT-2026-107798

An input validation vulnerability exists in the security certificate management component of the Brocade Fabric OS administrative management API. When processing certificate management operations, user-supplied certificate identifiers are handled without adequate sanitization prior to execution i...

PT-2026-107725

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 10.0.1 Description An authenticated user can execute arbitrary system commands through the REST API management interface by providing crafted input parameters. This issue is a command injection, which occurs...

PT-2026-107782

A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite MAPS violation data across...

PT-2026-107858

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

PT-2026-107846

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user,...

PT-2026-107953

Name of the Vulnerable Software and Affected Versions GlavSoft TightVNC Server for Windows versions prior to 2.8.88 Description Incorrect permission assignment allows a local authenticated user to read or overwrite the inter-process communication IPC handles used between the TightVNC service and...

PT-2026-107922

Name of the Vulnerable Software and Affected Versions MasterStudy LMS versions prior to 3.7.53 Description Stored Cross-site Scripting XSS occurs due to improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that are stored on the server a...

PT-2026-108042

Name of the Vulnerable Software and Affected Versions Obsidian Desktop versions prior to 1.14.0 Description Insufficient sanitization of the data-background-iframe attribute allows the bypass of DOMPurify. This issue is processed by the bundled Reveal.js 4.3.1 within the Slides core plugin,...

CVE-2026-92555: Insertion of Sensitive Information Into Sent Data

Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26...

A Survey of Security Research for Operating Systems

In recent years, information systems have become the social infrastructure, so that their security must be improved urgently. In this paper, we introduce the results of the survey of virtualization, operating system verification and access control technologies in association with the design...

PT-2026-107847

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an...

PT-2026-108142

Name of the Vulnerable Software and Affected Versions Amazon Agent Plugins for AWS databases-on-aws versions prior to 1.7.1 Description An incomplete list of disallowed inputs allows a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper. This...

PT-2026-107848

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against another user's wallet for an amount a...

PT-2026-107956

Name of the Vulnerable Software and Affected Versions GlavSoft TightVNC Server for Windows versions prior to 2.8.88 Description A local authenticated user can execute arbitrary code with SYSTEM privileges due to an uncontrolled search path element. The DynamicLibrary::init function and ThemeLib...

NTFS Privilege Escalation

The vulnerability of the NTFS file system in Windows operating systems is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

Windows Installer Privilege Escalation

The vulnerability of Windows operating system installers is related to the situation of a race between different actors. Exploiting this vulnerability can allow an attacker to increase their privileges...

ROS-20261008-73-0036

The vulnerability in the drivers/crypto/ccp/sev-dev.c module of the Linux operating system is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

PT-2026-107811

Name of the Vulnerable Software and Affected Versions Brocade Fabric versions prior to 9.2.2d Brocade Fabric versions 10.0.0 through 10.0.0a1 Description Improper handling of specific download protocols allows for the use of unsanitized parameter strings. During the processing of upgrade requests...

PT-2026-107883

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint...