PT-2026-66875

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...

CVE-2026-51953

FeehiCMS v2.1.1 is cited as affected, with a privilege-escalation issue via the Session management, authentication logic, and logout handler components. The provided description does not include concrete root-cause details, specific vulnerable functions/files, affected versions beyond v2.1.1, exp...

CVE-2026-51953

An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components...

The vulnerability of the FrodoEngine.Java file in the Bouncy Castle cryptographic library for the Java platform allows a hacker to disclose protected information.

The vulnerability of the bcpkix module in the Java Bouncy Castle cryptographic library relates to the use of hidden time channels for data transmission. Exploiting this vulnerability allows a remote attacker to disclose the protected information...

UBUNTU-CVE-2026-16526

A flaw in the PCP linuxsockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root...

The vulnerability of the jsonCacheInsert() function in the json.c module of the SQLite database management system allows a hacker to execute arbitrary code.

The vulnerability of the jsonCacheInsert function in the json.c module of the SQLite database management system is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code using a specially created JSON file...

PT-2026-66857

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

CVE-2026-50986

Technical details are not publicly available in the provided documents. Monitor for updates from official sources; no concrete information about affected versions, impact scope, or remediation is provided here.

PT-2026-66795

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...

CVE-2026-50986

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

PT-2026-66777

pgAdmin 4's Import/Export Data tool builds a psql copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, create import export job route POST /import...

PT-2026-66845

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

PT-2026-66773

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga login required decorator; the application's before request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication...

PT-2026-66837

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

MiracleLinux 9 : python3.14-3.14.5-1.el9_8 (AXSA:2026-1397:02)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1397:02 advisory. python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open API CVE-2026-4786 python: Python: Cross-Site Scripting XS...

The vulnerability of the bcpkix module in the Java Bouncy Castle cryptographic library allows a hacker to bypass existing security mechanisms.

The vulnerability of the bcpkix module in the Java Bouncy Castle cryptographic library is related to the use of the outdated cryptographic algorithm SHA-1. Exploiting this vulnerability allows a remote attacker to bypass existing security measures...

The vulnerability of the cpsw_ndo_set_rx_mode_work() function in the drivers/net/ethernet/ti/cpsw_new.c module of the Ethernet network adapter driver for Texas Instruments’ Linux kernel allows a hacker to cause a service failure.

The vulnerability of the cpswndosetrxmodework function in the drivers/net/ethernet/ti/cpswnew.c module of the Ethernet network adapter driver for Texas Instruments’ Linux operating system is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow an...

The vulnerability of Google Chrome browser’s Blink rendering module allows a hacker to execute arbitrary code.

The vulnerability of the Blink rendering module in Google Chrome browsers relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the th1520_aon_power_update() function in the drivers/firmware/thead module, located in the Linux kernel-based firmware, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the th1520aonpowerupdate function in the drivers/firmware/thead module, within the th1520-aon.c driver for Linux kernel patches, is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability...

The vulnerability of the DEFINE_IDA() function in the drivers/auxdisplay/line-display.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the DEFINEIDA function in the drivers/auxdisplay/line-display.c module of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...