CVE-2026-0302: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local user to execute arbitrary commands in the processes running Checkov...

CVE-2026-0306: Protection Mechanism Failure

A vulnerability in the EndPoint Data Loss Prevention DLP enforcement of Palo Alto Networks Prisma® Access Agent enables a local user to bypass configured DLP policy enforcement controls and exfiltrate sensitive data. This Prisma Access Agent on macOS, Linux, iOS, Android and Chrome OS is not...

CVE-2026-15419: Stack-based Buffer Overflow

In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to corrupt kernel pool memory, resulting in arbitrary code execution with escalated privileges...

CVE-2026-15418: Improper Handling of Length Parameter Inconsistency

In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packets to leak up to 145 bytes of uninitialized kernel pool memory. This vulnerability affects Windows 10 and earlier...

CVE-2026-15417: Divide By Zero

In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash...

CVE-2026-18994: Improper Export of Android Application Components

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...

CVE-2026-19136: Improper Neutralization of Special Elements used in an OS Command

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application...

ROS-20260910-73-0107

The vulnerability in Chromium is related to information representation errors in the user interface. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

ROS-20260910-73-0098

The vulnerability in Chromium is related to information representation errors in the user interface. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

PT-2026-89414

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convert markdown to pdf module. The attribute, objectAttribute,...

PT-2026-89541

Name of the Vulnerable Software and Affected Versions MongoDB integration for Laravel affected versions not specified Description Improper neutralization of special elements in data query logic within the embedded-document relation handling allows an authenticated user to manipulate an embedded...

CVE-2026-11813: Incorrect Default Permissions

A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges...

PT-2026-89544

Name of the Vulnerable Software and Affected Versions MongoDB Ruby Driver affected versions not specified Description Improper neutralization of special elements in the data query logic of the GridFS component allows a structured file identifier provided by a caller to be interpreted as a query...

PT-2026-89256

Name of the Vulnerable Software and Affected Versions BurgerEditor versions 3.0.0 through 3.4.0 Description An authorization bypass exists due to a user-controlled key. This allows an authenticated attacker to alter the content of the page. Recommendations At the moment, there is no information...

PT-2026-89516

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description Improper neutralization of regular-expression metacharacters in the LINQ query translation component allows an authenticated user to provide a character sequence that alters a...

PT-2026-89637

🚨 CVE-2026-81941 IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local std...

CVE-2026-88277: Improper Neutralization of Special Elements used in an OS Command

GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitrary commands as root...

PT-2026-89311

GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated...

PT-2026-89658

An information disclosure vulnerability in the SAML Single Sign-On SSO functionality of Omada Controller allows an authenticated user with SAML configuration privileges to access sensitive information due to insufficient validation of user-supplied SAML metadata. Successful exploitation could...

PT-2026-89482

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...