by Kastro CVE-2026-49952 · Discuz! Discuz! X5.0
The archive.
Browse all tracked critical vulnerabilities, including records outside today's brief.
38,935 matching vulnerabilities · Page 156 of 779
Discuz!
mitre
CVE-2026-50871 · mitre
An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows a…
CVE-2026-38329 · mitre
Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin.
CVE-2026-50869 · mitre
An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted requ…
CVE-2026-50872 · mitre
An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and o…
CVE-2026-36537 · mitre
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange.
CVE-2026-50880 · mitre
An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a…
CVE-2026-50873 · mitre
An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary cod…
CVE-2026-39196 · mitre
Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner:…
CVE-2026-50883 · mitre
An HTML injection vulnerability in the /src/highlight.rs component of matze wastebin v3.4.1 allows attackers to execute arbitrary scripts…
CVE-2026-50890 · mitre
Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /stockreports/spendings.
CVE-2026-38065 · mitre
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter.
CVE-2026-45390 · mitre
In OCaml-tar before 3.4.0, a crafted archive with ../ path segments in its name allows escaping the current working directory.
CVE-2026-38060 · mitre
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin parameter.
CVE-2026-38061 · mitre
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter.
CVE-2026-38062 · mitre
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter.
CVE-2026-38063 · mitre
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter.
CVE-2026-38064 · mitre
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter.
CVE-2026-50886 · mitre
Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources vi…
CVE-2026-50887 · mitre
A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan inte…
CVE-2026-30120 · mitre
remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.
CVE-2026-45388 · mitre
In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows imp…
CVE-2026-39006 · mitre
An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.
CVE-2026-38812 · mitre
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint.
CVE-2026-30121 · mitre
remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability.
team-alembic
CVE-2026-49757 · team-alembic ash_authentication
OAuth2/OIDC account takeover in AshAuthentication via email-based user matching
RURBAN
Fortra
CVE-2026-9862 · Fortra Core Privileged Access Manager (BoKS)
Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability
CMSJunkie – WordPress Business Directory Plugins
CVE-2026-39591 · CMSJunkie – WordPress Business Directory Plugins WP-BusinessDirectory
WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability
CRM Perks
CVE-2026-9691 · CRM Perks Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms
WordPress Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.1.1 - PHP Object Injection vulnerability
MetaSlider
CVE-2026-39465 · MetaSlider Responsive Slider by MetaSlider
WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - Remote Code Execution (RCE) vulnerability
Nefteprodukttekhnika LLC
CVE-2026-12183 · Nefteprodukttekhnika LLC BUK TS-G Gas Station Automation System
Nefteprodukttekhnika BUK TS-G Gas Station Automation System Authentication Bypass via ajax-login.php Accepting Arbitrary Credentials
NCEAS
Tecrail
CVE-2026-5482 · Tecrail Responsive FileManager
Remote Code Execution via Unrestricted File Upload in Responsive FileManager
VideoWhisper.com
CVE-2026-27053 · VideoWhisper.com Broadcast Live Video
WordPress Broadcast Live Video plugin < 7.1.3 - PHP Object Injection vulnerability
Datalogics
CVE-2026-39583 · Datalogics Datalogics Ecommerce Delivery
WordPress Datalogics Ecommerce Delivery plugin <= 2.6.62 - Privilege Escalation vulnerability
Edgar Rojas
CVE-2026-52704 · Edgar Rojas WooCommerce PDF Invoice Builder
WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Remote Code Execution (RCE) vulnerability
Imagination Technologies
CVE-2026-41157 · Imagination Technologies Graphics DDK
GPU DDK - OOB Write in CalculateNPOTTwiddleSparsePageMap3D
Paul
Flipper Code – WordPress Development Company
CVE-2026-39492 · Flipper Code – WordPress Development Company WP Maps
WordPress WP Maps plugin <= 4.9.1 - SQL Injection vulnerability
NSquared
CVE-2026-39493 · NSquared Simply Schedule Appointments
WordPress Simply Schedule Appointments plugin <= 1.6.9.27 - SQL Injection vulnerability
Unknown
10Web
CVE-2026-39502 · 10Web Form Maker by 10Web
WordPress Form Maker by 10Web plugin <= 1.15.38 - SQL Injection vulnerability
Ahmad
Jacob N. Breetvelt
CVE-2026-39511 · Jacob N. Breetvelt WP Photo Album Plus
WordPress WP Photo Album Plus plugin <= 9.1.08.001 - SQL Injection vulnerability
Naked Cat Plugins (by Webdados)
CVE-2026-39441 · Naked Cat Plugins (by Webdados) Feed KuantoKusta for WooCommerce – Free
WordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerability
OpenClaw
Paolo
SpeakOut!
CVE-2026-39530 · SpeakOut! SpeakOut! Email Petitions