970 matches found
WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability
Payment Bypass vulnerability discovered by Alexis Lafontaine in WordPress Plugin SMEPay: UPI Gateway for WooCommerce versions = 1.0.5...
CVE-2026-48078
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the unauthenticated /api/tenants/id/schedule endpoint returns every non-archived channel for a tenant regardless of the channel's isPublic flag. Channels marked...
CVE-2026-48075
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the add-to-tunnel endpoint creates a new appointment row in any client tunnel without any caller authentication. A request that supplies any valid tunnelId and any...
CVE-2026-48078
OpenReception’s CVE-2026-48078 affects the scheduling endpoint prior to version 1.0.5. The unauthenticated /api/tenants/{id}/schedule endpoint exposed all non-archived channels for a tenant, including those with isPublic = false, disclosing channel names, descriptions, IDs, agent associations, pa...
CVE-2026-48075 OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the add-to-tunnel endpoint creates a new appointment row in any client tunnel without any caller authentication. A request that supplies any valid tunnelId and any...
CVE-2026-48075 OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the add-to-tunnel endpoint creates a new appointment row in any client tunnel without any caller authentication. A request that supplies any valid tunnelId and any...
CVE-2026-11980
The CVE-2026-11980 entry affects IBM Aspera Desktop App versions 1.0.5 through 1.0.19. The issue allows arbitrary code execution by loading DLL files at startup, stemming from Use of Inherently Dangerous Function (CWE-242). Impact is high (Local with user interaction required, per CVSS: 3.1, AV:L...
PT-2026-66482
Name of the Vulnerable Software and Affected Versions IBM Aspera Desktop App versions 1.0.5 through 1.0.19 Description An issue exists that allows arbitrary code execution by loading DLL files during the application start-up process. Recommendations At the moment, there is no information about a...
CVE-2026-14973 Path Traversal in IBM Desktop App
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination...
CVE-2026-14973
IBM Aspera Desktop App versions 1.0.5–1.0.19 are affected by CVE-2026-14973, a path traversal flaw that can allow files to be written outside the user-selected download destination. The IBM Security Bulletin (CVE-2026-14973) and related records confirm the vulnerable component and version range, ...
CVE-2026-14973 Path Traversal in IBM Desktop App
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination...
Security Bulletin: Multiple vulnerabilities in IBM Desktop App
Summary Multiple vulnerabilities were addressed in IBM Aspera Desktop App v1.1.0. Vulnerability Details CVEID:CVE-2026-11980 DESCRIPTION: IBM Aspera Desktop App can allow arbitrary code execution by loading DLL files at start-up. CWE:CWE-242: Use of Inherently Dangerous Function CVSS Source: IBM...
EUVD-2026-43271
A vulnerability has been found in better-auth better-icons up to 1.0.5. This vulnerability affects unknown code of the component scanprojecticons/syncicon. Such manipulation of the argument iconsfile leads to path traversal. An attack has to be approached locally. The exploit has been disclosed t...
CVE-2026-57585 affecting package python-msgpack for versions less than 1.0.5-3
CVE-2026-57585 affecting package python-msgpack for versions less than 1.0.5-3. A patched version of the package is available...
CVE-2026-14459
Improper neutralization of argument delimiters in a command 'argument injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...
EUVD-2026-41552
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...
EUVD-2026-41550
Improper neutralization of argument delimiters in a command 'argument injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...
CVE-2026-14459 Argument Injection in TUBITAK BILGEM's pardus-software
Improper neutralization of argument delimiters in a command 'argument injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from = 1.0.4 before 1.0.5...
PT-2026-55543
Name of the Vulnerable Software and Affected Versions pardus-software versions prior to 1.0.5 Description A missing authorization issue allows for argument injection, which occurs when an application fails to properly sanitize user-supplied input used as arguments to a command or function,...