CVE-2026-115497 Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter

The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contai...

CVE-2026-115497

The Music Store WordPress eCommerce plugin is vulnerable to Directory Traversal in all versions up to and including 1.4.7 . The flaw exists in the 'f' parameter , allowing unauthenticated attackers to read arbitrary files on the server, potentially exposing sensitive information. Successful explo...

CVE-2022-51023

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...

EUVD-2022-56067

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...

VulnCheck KEV: CVE-2022-51023

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information throug...

CVE-2026-114123

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey...

CVE-2026-114123 D365 F&O MCP Server: Official Azure one-click deployment ships with authentication disabled by default, exposing proprietary X++ source over the public internet

D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey...

CVE-2026-114123

The D365 F&O MCP Server is vulnerable to unauthenticated access in versions prior to 1.11.0 due to insecure default configurations in the official Azure one-click deployment. The deployment files (infrastructure/azuredeploy.json and infrastructure/main.bicep) default the apiKey to an empty string...

PT-2026-116988

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f uac1 legacy: validate bRequest index in generic set,get cmd generic set cmd and generic get cmd use the low nibble of ctrl-bRequest as an index into con-data: u8 cmd = ctrl-bRequest & 0x0F; / 0 .. 15 /...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: facm: Refactor the bind path to use free After a bind/unbind cycle, the acm-notifyreq remains stale. If a subsequent bind fails, the unified error handling mechanism attempts to free this stale request. This leads to...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfc: Digital: Clamping the resp-len length to the NFCSENSFRESMAXSIZE bytes. This involves copying data from a remote NFC-F device’s response into the NFCSENSFRESMAXSIZE bytes of the struct sensfres structure. There was no...

Astra Linux – Vulnerability in zsh

In zsh before version 5.8.1, an attacker can gain code execution if they control the command output within the prompt, as demonstrated by using a %F argument. This occurs due to the recursive PROMPTSUBST expansion...

PT-2026-115169

Name of the Vulnerable Software and Affected Versions WildMIDI versions 0.5.0 and earlier Description A heap out-of-bounds read occurs in the WM ParseNewHmi function within src/f hmi.c when handling 0xfe sub-events. An attacker can provide a specially crafted HMI file containing a 0xfe 0x10...

CVE-2026-92160

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because the wrapping sum bypasses file-range validation, becomes mendOffset, and leaves mbyteOffs...

CVE-2026-92158

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound ...

CVE-2026-92159

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::TlmPacketizer TlmRecvhandler fixed-slot copy TlmRecvhandler copies val.getSize bytes into entry.channelSize storage without confirming that the runtime...

CVE-2026-92157

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileDownlink SendPartial range validation is vulnerable because unchecked startOffset plus length arithmetic bypasses the range check and stores a wrappe...

CVE-2026-92154

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FileUplink handleDataPacket offset and size validation is vulnerable because the component checks byteOffset plus dataSize with wrapping U32 arithmetic a...

CVE-2026-92155

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Fw::FilePacket deserialization used by Svc::FileUplink is vulnerable because Header deserialization casts the byte to the Type enum without validating its ran...

CVE-2026-92156

F´ F Prime is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::EventManager loqQueueinternalInterfaceHandler packetization is vulnerable because EventManager accepts up to the framework LogBuffer maximum, but packet...