PT-2026-41689

Name of the Vulnerable Software and Affected Versions Neotoma versions 0.6.0 through 0.11.0 Description Neotoma can treat public reverse-proxied requests as local when the application receives them over a loopback socket and no Bearer token is present. This occurs in deployments behind a reverse...

PT-2026-41706

Name of the Vulnerable Software and Affected Versions HSC MailInspector version 5.3.3-7 Description Improper validation of user-supplied input in the '/tap/dw.php' endpoint allows a remote attacker to access arbitrary files on the underlying operating system, leading to unauthorized disclosure of...

CVE-2026-29963

CVE-2026-29963 affects HSC MailInspector 5.3.3-7. The vulnerability is a Path Traversal in the /tap/dw.php endpoint where the text parameter is used to build file paths without proper normalization or safe base-directory restriction. This improper input validation can allow a remote attacker to a...

The vulnerability of the Next.js software platform for creating web applications stems from insufficient validation of requests on the server side. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Next.js web application development software platform is related to insufficient validation of requests at the server side. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Next.js web application development software platform, related to deficiencies in authentication procedures, allows attackers to bypass existing security mechanisms and gain unauthorized access to protected information.

The vulnerability of the Next.js web application development software platform is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker to bypass existing security mechanisms and gain unauthorized access to protected information...

📄 Lobster_pro Arbitrary File Read / Server-Side Request Forgery

Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobsterpro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services. -----BEGIN PGP...

TinyIce: Missing authentication on WebRTC ingest endpoint allows unauthorized stream injection

TinyIce's WebRTC source-ingest HTTP endpoint, POST /webrtc/source-offer?mount=, accepted any inbound WebRTC SDP offer with no authentication check. The handler routed the offer to WebRTCManager.HandleSourceOffer, which then accepted whatever audio/video tracks the peer published and broadcast the...

PT-2026-55909

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description Improper input validation in the Atmosphere WebSocket component allows an unauthenticated remote...

PT-2026-41709

Name of the Vulnerable Software and Affected Versions Azure Local Disconnected Operations affected versions not specified Description Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment,...

Mattermost 安全漏洞

Mattermost is an open-source collaboration platform developed by the American company Mattermost. Versions of Mattermost such as 11.5.1 and earlier 11.5.x series, 10.11.13 and earlier 10.11.x series, and 11.4.3 and earlier 11.4.x series have security vulnerabilities. These vulnerabilities stem fr...

PT-2026-41635

Name of the Vulnerable Software and Affected Versions Feeds for YouTube versions prior to 2.6.4 Description A missing capability check in the actions function allows users with subscriber privileges or higher to unauthorizedly modify or delete the plugin license key. Recommendations Update to...

NOVUS Automation AirGate 4G firmware 安全漏洞

NOVUS Automation AirGate 4G firmware is an industrial IoT gateway firmware system developed by NOVUS Automation in Brazil. Version 1.1.16 of NOVUS Automation AirGate 4G firmware contains a security vulnerability. This vulnerability stems from improper endpoint access control in the /uci/get/...

PT-2026-41722

Name of the Vulnerable Software and Affected Versions HCL Connections affected versions not specified Description Broken access control may allow an unauthorized user to update data in certain scenarios. Recommendations At the moment, there is no information about a newer version that contains a...

PT-2026-70612

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper input validation allows an unauthorized attacker to execute arbitrary code over a network, which can lead to a full system compromise. Recommendations At the...

📄 Bichon 1.0.2 SOCKS5 Proxy Topology Disclosure

Bichon version 1.0.2 suffers from a SOCKS5 proxy topology disclosure vulnerability via /list-proxy. Bichon 1.0.2 SOCKS5 Proxy Topology Disclosure via /list-proxy ============================================================= Vendor: rustmailer Product: Bichon - self-hosted email archiving server...

iCMS 安全漏洞

iCMS is a software application. It is a highly efficient and concise content management system built using PHP and MySQL. iCMS has security vulnerabilities, which stem from authorization bypasses. This could allow attackers to gain unauthorized access by manipulating HTTP redirect headers during...

HCL Connections 安全漏洞

HCL Connections is a corporate collaboration platform developed by the Indian company HCL. There is a security vulnerability in HCL Connections, which stems from ineffective access control. This vulnerability may allow unauthorized users to update data in certain scenarios...

Tencent WeKnora 授权问题漏洞

Tencent WeKnora is an enterprise-level LLM knowledge base and RAG platform developed by Tencent, a Chinese technology company. Versions of Tencent WeKnora prior to 0.3.6 contained an authorization vulnerability. This vulnerability stemmed from the function getKnowledgeBaseForInitialization in the...

The vulnerability of the software for storing and analyzing distributed tracebacks of Grafana Tempo, related to the storage of information in an open manner, allows a perpetrator to gain unauthorized access to the protected information.

The vulnerability of the software for storing and analyzing distributed tracebacks of Grafana Tempo involves the storage of information in an open manner. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of Mozilla Firefox web browsers and Thunderbird email client’s WebRTC component allows attackers to gain unauthorized access to protected information.

The vulnerability of the WebRTC component in Mozilla Firefox and the Thunderbird email client is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...