116759 matches found
CVE-2026-80152
Lantronix SLC8000 (before firmware v9.7.0.3), EMG8500/EMG7500 (before v9.7.0.1), and SLB882/SLCx-03/SLCx-02 (all firmware versions) contain an OS command injection in the set script schedule command, which passes unsanitized user input to a system() call. An authenticated attacker with the servic...
EUVD-2026-84519
Lantronix SLC8000 before firmware v9.7.0.3, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitrary shell commands as root by...
CVE-2026-80152 Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule
Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a command injection vulnerability that allows authenticated attackers with the services permission to execute arbitra...
CVE-2026-93616
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...
EUVD-2026-84375
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...
CVE-2026-93616 Directory Traversal and File upload allows execution of arbitrary script on the Management Server
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...
CVE-2026-93616 Directory Traversal and File upload allows execution of arbitrary script on the Management Server
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...
CVE-2026-93616
A pre-authentication directory traversal vulnerability exists in the Check Point Management Web Service , affecting Check Point Security Management and Log Servers. This flaw allows unauthenticated attackers to upload and execute arbitrary scripts, potentially leading to remote code execution . A...
CVE-2026-93836
The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty' parameter in all versions up to, and including, 8.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-93778 WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)
The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text imported via wpyelpdownloadsource in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-93778 WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)
The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text imported via wpyelpdownloadsource in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-93655
The Booking Calendar WordPress plugin is affected by a Reflected Cross-Site Scripting vulnerability via the wpbc_auto_fill parameter in all versions up to and including 11.8.3 . The root cause is insufficient input sanitization and output escaping . An unauthenticated attacker can inject arbitrar...
CVE-2026-93655 Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpbcautofill' parameter in all versions up to, and including, 11.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-85653 Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'otherattributes' Block Parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-79315
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2023-000317)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-000317 advisory. Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line. Git GU...
Check Point Multiple Products Path Traversal Vulnerability
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts...
VulnCheck KEV: CVE-2026-93616
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...
PT-2026-96842
Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.8 Description The Folder as Workspace Run by system action can resolve a sibling file different from the one selected by the user. On Windows 10 or Windows 11, if an attacker places a command script with the sam...
EUVD-2026-84465
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the...