EUVD-2026-66361

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.10. This is due to the wpdisplay shortcode handler, used by multiple shortcodes, allowing attacker-controlled htmltags values to define raw HTML tags a...

CVE-2026-2388

The Reviews and Rating – Google Reviews WordPress plugin (slug: g-business-reviews-rating) is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.10 . The root cause lies in the wp_display() shortcode handler, which allows attacker-controlled html_tags values to define...

CVE-2026-77535

CVE-2026-77535 is an Improper Input Validation vulnerability in UniFi Network Application that allows a network-based, high-privilege actor to achieve Command Injection on an adopted device. The CNA-assigned CVSS 3.1 score is 9.1 (Critical) with a Changed Scope and High impact across Confidential...

CVE-2026-48749

A flaw was found in Incus, a container and virtual machine manager. A crafted container image can use a symlink in the rootfs directory to read or write arbitrary files on the host, potentially leading to command execution. Mitigation No mitigation is needed as Incus is not shipped in any Red Hat...

CVE-2026-77534

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances...

CVE-2026-77534

CVE-2026-77534 is an Improper Access Control vulnerability affecting certain devices running UniFi OS (Ubiquiti). A low-privileged actor with network access can exploit it to escalate privileges within affected UniFi OS devices or instances. The CNA-assigned CVSS 3.1 score is 9.9 (CRITICAL) , ref...

CVE-2026-80234

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure...

CVE-2026-19538

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...

CVE-2026-18664

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

CVE-2026-19197

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

CVE-2026-77533

UniFi Protect Application (Ubiquiti) is affected by an Improper Input Validation flaw that enables Command Injection on the host device. An attacker with network access and low privileges can exploit this without user interaction. The CVSS 3.1 score is 9.9 (Critical) , reflecting changed scope wi...

CVE-2024-3217-POC

CVE-2024-3217-POC Mitre Beschreibung Das WP Directory Kit Plugin für WordPress ist anfällig für SQL-Injection über die Parameter 'attributevalue' und 'attributeid' in allen Versionen bis einschließlich 1.3.0. Dies liegt an unzureichender Maskierung der benutzergesteuerten Parameter und fehlender...

CVE-2026-19197 Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

EUVD-2026-66377

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

CVE-2026-19197

CVE-2026-19197 is a broken access control vulnerability in Grafana 's dashboard snapshots feature. An organization administrator on a shared Grafana instance can delete snapshots belonging to other organizations and recover a snapshot's secret delete key using only its public share key , enabling...

CVE-2026-19197 Broken access control in dashboard snapshots

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key broken access control...

CVE-2026-19538 Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...

EUVD-2026-66376

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...

CVE-2026-19538

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...

EUVD-2026-66347

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...