CVE · página 3 de 43

CVE CVE-2026-108054

CVE-2026-108054

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

CVE CVE-2026-108053

CVE-2026-108053

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

CVE CVE-2026-108052

CVE-2026-108052

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

CVE CVE-2026-108060

CVE-2026-108060

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

CVE CVE-2026-108059

CVE-2026-108059

A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.

CVE CVE-2026-121458

CVE-2026-121458

Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to…

CVE CVE-2026-76124

CVE-2026-76124

The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function.

CVE CVE-2026-65160

CVE-2026-65160

NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of service.

CVE CVE-2026-99270

CVE-2026-99270

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler()…

CVE CVE-2026-120327

CVE-2026-120327

The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.

CVE CVE-2026-77691

CVE-2026-77691

ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA

CVE CVE-2026-120333

CVE-2026-120333

The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash.

CVE CVE-2026-120332

CVE-2026-120332

The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in…

CVE CVE-2026-89229

CVE-2026-89229

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the…

CVE CVE-2026-77778

CVE-2026-77778

ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.

CVE CVE-2026-77777

CVE-2026-77777

ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.

CVE CVE-2026-89293

CVE-2026-89293

In Eclipse Mnestix Browser versions 1.2.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to perform actions that are only allowed to be executed by an authorized Mnestix…

CVE CVE-2026-89292

CVE-2026-89292

In Eclipse Mnestix Browser versions 1.6.0 up until but excluding 2.3.0 it was possible for an unauthenticated attacker to exfiltrate the MNESTIX_BACKEND_API_KEY for all configured Infrastructures.

CVE CVE-2026-114442

CVE-2026-114442

Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path.

CVE CVE-2026-120559

CVE-2026-120559

The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefd_remove_uploaded_file() function in all…

CVE CVE-2026-120558

CVE-2026-120558

The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the `tracking_provider` parameter of the `POST…

CVE CVE-2026-120538

CVE-2026-120538

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2.

CVE CVE-2026-76955

CVE-2026-76955

A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.

CVE CVE-2026-107441

CVE-2026-107441

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and…

CVE CVE-2026-119736

CVE-2026-119736

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker…

CVE CVE-2026-119731

CVE-2026-119731

Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication…

CVE CVE-2026-99236

CVE-2026-99236

In the Linux kernel, the following vulnerability has been resolved: tracing: Reject incomplete event filter expressions A non-empty expression normally finishes in predicate_parse()'s inner loop…

CVE CVE-2026-120216

CVE-2026-120216

fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream…

CVE CVE-2026-120215

CVE-2026-120215

@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS…

CVE CVE-2026-120214

CVE-2026-120214

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix.

CVE CVE-2026-120213

CVE-2026-120213

@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix.

CVE CVE-2026-8923

CVE-2026-8923

Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.

CVE CVE-2026-120426

CVE-2026-120426

OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files.

CVE CVE-2026-91909

CVE-2026-91909

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability.

CVE CVE-2026-120534

CVE-2026-120534

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function.

CVE CVE-2026-120518

CVE-2026-120518

The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0.

CVE CVE-2026-86596 PoC público

CVE-2026-86596

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter.

CVE CVE-2026-102435

CVE-2026-102435

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and…

CVE CVE-2026-77876

CVE-2026-77876

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by…

CVE CVE-2026-120446

CVE-2026-120446

madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform'…

CVE CVE-2025-7441 PoC público

CVE-2025-7441

The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42.

CVE CVE-2026-120442

CVE-2026-120442

ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json.