CVE-2026-108983: Improper Neutralization of Special Elements used in an OS Command

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe...

PT-2026-117200

A vulnerability is in Web Server default connection ports under the process name GeoWebServer.exe...

CVE-2026-111406: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1...

Linux Distros Unpatched Vulnerability : CVE-2026-102608

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single...

CVE-2026-102607

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events...

EUVD-2026-103154

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit...

CVE-2026-111710

Netcore NR256CN through 1.5.140116 is affected by a NULL pointer dereference vulnerability within the Boa web server's user_auth() function. An unauthenticated attacker can trigger this vulnerability by sending a malformed Basic Authorization header that lacks a colon (e.g., decoding to a single ...

CVE-2026-111710 Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS

Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's userauth function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Authorization value lacking a colon, such as on...

CVE-2026-30971: Improper Neutralization of Special Elements used in an OS Command

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit...

PT-2026-116148

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.39.2 ZoneMinder versions prior to 1.38.2 ZoneMinder versions prior to 1.36.40 Description An authenticated user with monitor-create or monitor-edit permissions can execute arbitrary commands as the web server use...

Astra Linux – Vulnerability in nbconvert

The GitHub Security Lab identified sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML, which may lead to cross-site scripting XSS vulnerabilities if...

Astra Linux – Vulnerability in Apache2

Improper neutralization of vulnerabilities related to escape, meta, or control sequences in the Apache HTTP Server, caused by unexpected overrides of variables calculated by the server for CGI programs, through environment variables set via Apache configuration. This issue affects the Apache HTTP...

Astra Linux – Vulnerability in libsoup2.4

A flaw was discovered in libsoup, where SoupAuthDigest is vulnerable to a NULL pointer dereference. The HTTP server may cause the libsoup client to crash...

Astra Linux – Vulnerability in Apache2

When an HTTP/2 stream is reset by a client via an RST frame, there is a time window during which the memory resources associated with the request are not immediately reclaimed. Instead, the deallocation of these resources is delayed until after the connection is closed. This allows clients to...

Astra Linux – Vulnerability in Apache2

An HTTP response smuggling vulnerability exists in the Apache HTTP Server via modproxyuwsgi. This issue affects the Apache HTTP Server: from version 2.4.30 through 2.4.55. Special characters in the origin response header can cause the response forwarded to the client to be truncated or split...

Zyxel NAS Firmware 5.21- Remote Code Execution

Multiple Zyxel network-attached storage NAS devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. Zyxel NAS devices achieve authentication by using th...

EUVD-2026-100980

A vulnerability involving improper access control in the TSplus Remote Access web server that allows an unauthenticated remote attacker to access internal resources protected by manipulated paths through the /socket.io/JWN/ endpoint, bypassing the access restrictions intended for certain internal...

CVE-2026-55679: Improper Neutralization of Special Elements used in an OS Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-63350

Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow...

PT-2026-111380

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC Drive Controller CPU 1504D TF affected versions not specified Description Devices do not properly restrict executable content within imported trace files. An attacker could social engineer an authorized user with the "Read...