BELL-CVE-2026-72129

Bulletin has no description...

BELL-CVE-2026-72027

Bulletin has no description...

CVE-2026-75090

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convertgguftohftokenizer of the file mistralrs-core/src/gguf/gguftokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eostokenid/bostokenid/unknowntokenid results...

CVE-2026-75151 SourceCodester Onlne Examination & Learning Management System cross-site request forgery

A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely...

MINI-RQVM-5M89-6994

Bulletin has no description...

MINI-3WQH-G82Q-VJC4

Bulletin has no description...

MINI-PH87-QFQR-577W

Bulletin has no description...

MINI-VV75-RWWH-JRCQ

Bulletin has no description...

MINI-JCWW-PGRV-6XW5

Bulletin has no description...

MINI-3684-RRVQ-7WMF

Bulletin has no description...

PT-2026-77100

Unauthenticated Cross Site Scripting XSS in URL Shortify = 2.5.0 versions...

PT-2026-80763

Name of the Vulnerable Software and Affected Versions resdata versions prior to 6.2.9 Description The software fails to correctly validate input within GRDECL files. This issue is particularly critical when the tool is used to parse untrusted files in networking contexts, such as webservices...

PT-2026-77236

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...

PT-2026-77306

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the DEVICE BROWSE, DEVICE NODE ATTRIBUTE, HOST INTERFACES, and DEVICE TAGS REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag...

PT-2026-78017

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Endeca Application Controller component allows an unauthenticated attacker with network access via HTTP to compromise the system...

PT-2026-77978

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Content Acquisition System component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successf...

LifeOS 7.40.4

LifeOS is a Life Operating System. It knows your goals, the people who matter to you, and where you are right now, and it works to move you toward where you want to be. The engine underneath is a verifiable loop: turn any request into testable criteria, then climb until they pass. This is the fir...

PT-2026-77203

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/product question.sql queries...

Fixed in Apache Tomcat 11.0.25

Low: Authenticated WebSocket session survives end of HTTP session CVE-2026-73180 If the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not be closed as required by the...

PT-2026-78240

Name of the Vulnerable Software and Affected Versions 4gaBoards versions prior to 3.3.9 Description An authenticated user can modify backend-managed identity attributes via the 'PATCH /api/users/:id' endpoint. This occurs because the whitelist in the update.js controller allows mass assignment of...