PT-2026-93851

Name of the Vulnerable Software and Affected Versions Dell Update Package Framework versions prior to 26.07.03 Description A Stack-based Buffer Overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold, potentially overwriting adjacent...

PT-2026-93842

Name of the Vulnerable Software and Affected Versions Dell Update Package Framework versions prior to 26.07.03 Description An Unchecked Return Value issue exists where the software fails to properly verify the result of a function call. A low privileged attacker with local access can exploit this...

PT-2026-93841

Name of the Vulnerable Software and Affected Versions Dell Update Package Framework versions prior to 26.07.03 Description An OS Command Injection issue exists due to improper neutralization of special elements used in an OS command. A low privileged attacker with local access could exploit this...

PT-2026-93843

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access 'Link Following' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker...

PT-2026-93844

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access 'Link Following' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker...

PT-2026-93691

Name of the Vulnerable Software and Affected Versions a2ui versions 0.9 through 0.9.1 Description A remote manipulation of the updateComponents function within the basic functions.ts file of the Update Components component can lead to excessive resource consumption. Recommendations At the moment,...

PT-2026-93429

Name of the Vulnerable Software and Affected Versions VEO Wi-Fi monitors versions prior to 01.48.001 VEO-XS Wi-Fi monitors versions prior to 01.48.001 Description The software fails to validate TLS certificates during the firmware update download process. This flaw enables a man-in-the-middle...

PT-2026-93612

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the NVMe subsystem where the nvme update ns info block function fails to correctly handle positive NVMe status codes returned by nvme query zone info, only checking fo...

PT-2026-93812

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 5.1 Description An authorization bypass exists in the 'POST /user/form/data/update' endpoint. This issue allows authenticated users to overwrite form submission data belonging to other users. Attackers can...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38402)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in TOTOLINK T6. This vulnerability stems from improper access control in the CloudSrvVersionCheck function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38420)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the informSlaveUpdate function. Attackers can exploit this vulnerability by sending a specially crafted POS...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38587)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the informSyncUpgfw function. Attackers can exploit this vulnerability by sending specially crafted MQTT...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38591)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in TOTOLINK T6. This vulnerability stems from improper access control in the meshSlaveUpgfw function. Attackers can exploit this vulnerability by sending a specially crafted MQTT message...

CVE-2026-86003: Unintended Proxy or Intermediary

CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/serverquic.go, and core/dnsserver/servergrpc.go call dns.Msg.Unpack without the dns.DefaultMsgAcceptFunc request policy...

CVE-2026-71182: Improper Link Resolution Before File Access

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access 'Link Following' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker...

CVE-2026-71181: Improper Link Resolution Before File Access

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access 'Link Following' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker...

CVE-2026-71180: Unchecked Return Value

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-71179: Improper Neutralization of Special Elements used in an OS Command

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileg...

CVE-2026-92385: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/updatecategory.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit h...

CVE-2026-92567: Authorization Bypass Through User-Controlled Key

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify...