PT-2026-99545

Name of the Vulnerable Software and Affected Versions TOTOLINK N150RT version 3.4.0-B20201030 Description The Web Management Interface contains a flaw in the /boafrm/formWlSiteSurvey endpoint. Specifically, the system function fails to properly sanitize the wlanif argument, allowing a remote...

CVE-2026-94132

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension 11.1.0 - MIME parts of incoming emails were saved to media/comacym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PH...

CRLF Injection

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to CRLF Injection in the validateUrl process. An attacker can inject arbitrary web-server configuration lines by supplying a crafted subdomain redirect URL containing carriage return and...

CVE-2026-94132

The AcyMailing Enterprise extension for Joomla (versions 1.0.0 – 11.0.5 ) contains a Remote Code Execution (RCE) vulnerability. The root cause is that the mailbox actions in POP3 mode save incoming MIME attachments to the media/com_acym/upload/ directory without performing extension checks. This ...

CVE-2026-94132 Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension 11.1.0 - MIME parts of incoming emails were saved to media/comacym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PH...

[SECURITY] [DLA 4797-1] lemonldap-ng security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4797-1 [email protected] https://www.debian.org/lts/security/ Xavier Guimard September 26, 2026 https://wiki.debian.org/LTS -...

ShinyHunters Bypass WAF Rules to Resume Oracle PeopleSoft Attacks

ShinyHunters exploit CVE-2026-35273 in Oracle PeopleSoft using URL encoding to bypass WAF rules, deploy web shells and spread the SIDEEYE backdoor...

EUVD-2026-87690

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

Astra Linux – Vulnerability in Chromium

Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. Chromium security severity: Medium...

Exploit for CVE-2026-13249

CVE-2026-13249 — Honeywell PD45 Unauthenticated File Upload R...

Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells

Google is warning of renewed mass exploitation of a known security vulnerability in Oracle PeopleSoft as part of a campaign targeting multiple sectors globally. The ShinyHunters-linked activity involves the weaponization of CVE-2026-35273 CVSS score: 9.8, a critical security flaw that could resul...

Exploit for CVE-2026-14281

LANGZ Scanner + Exploit Mass scanner + single-target Exploi...

Buffalo WSR-2533DHPL2 - Path Traversal

Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 are susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to bypass authentication in their web interfaces. id: CVE-2021-20090 info: name: Buffalo WSR-2533DHPL2 - Path...

EUVD-2026-87349

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the...

EUVD-2026-87347

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - UploadWizard Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - UploadWizard Extension: from before 1.46.1, 1.45.5, 1.43.10...

EUVD-2025-26672

Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-100717: Improper Neutralization of CRLF Sequences

froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed characters only in the path, query and fragment components returned by parseurl, and never inspects the userinfo user:pass@ components. This is an incomplete fix f...

openSUSE 16: MozillaFirefox / MozillaFirefox-branding-upstream / etc (openSUSE-SU-2026:21951-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21951-1 advisory. Update to Firefox Extended Support Release 153.3.0 ESR MFSA 2026-93, bsc1280371: - CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs...

PT-2026-99388

Name of the Vulnerable Software and Affected Versions froxlor versions prior to 2.3.12 Description An authenticated low-privilege customer with subdomain-create rights can inject arbitrary web-server configuration lines. The Validate::validateUrl function fails to inspect the userinfo component o...

CVE-2026-100383

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Cross-Site Scripting XSS. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the...