CVE-2025-67840

Multiple authenticated OS command injection vulnerabilities exist in the Cohesity formerly Stone Ram TranZman 4.0 Build 14614 through TZM1757588060SEP2025FULL.depot web application API endpoints including Scheduler and Actions pages. The appliance directly concatenates user-controlled parameters...

CVE-2026-3342 WatchGuard Firebox Out of Bounds Write Vulnerability

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS may allow an authenticated privileged administrator to execute arbitrary code with root permissions via an exposed management interface. This vulnerability affects Fireware OS 11.9 up to and including 11.12.4Update1, 12.0 up to and...

CVE-2026-3342

Technical details about CVE-2026-3342 are not provided in the supplied documents. Monitor for updates from WatchGuard advisory; no public details on affected firmware behavior, exploit methods, or fixes are disclosed here.

CVE-2026-1487 LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on the user-supplied JSON data. This makes it possible for authenticated attackers...

CVE-2025-67840

CVE-2025-67840 corresponds to multiple authenticated OS command injection vulnerabilities in Cohesity TranZman 4.0 Build 14614 (TZM_1757588060_SEP2025_FULL.depot). The web API endpoints (including Scheduler and Actions) concatenate user-controlled parameters into system commands, allowing an auth...

GHSA-V8JW-8W5P-23G3 AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

Summary An authenticated Remote Code Execution RCE vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient...

AVideo has Authenticated Remote Code Execution via Unsafe Plugin ZIP Extraction

Summary An authenticated Remote Code Execution RCE vulnerability was identified in AVideo related to the plugin upload/import functionality. The issue allowed an authenticated administrator to upload a specially crafted ZIP archive containing executable server-side files. Due to insufficient...

CVE-2026-0689 XIQ‑SE NAC Admin Credential Exposure via HTTP Response

In ExtremeCloud IQ – Site Engine XIQ‑SE before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns th...

CVE-2026-0689

Affected product/versions: ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10. Vulnerable component: NAC administration interface. Root cause / flaw: Authenticated NAC admin requests return underlying credential values in HTTP responses while UI shows redacted values, enabling recovery of stor...

PT-2026-22993

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 24.0 Description AVideo is an open source video platform. A Remote Code Execution RCE issue was identified in the plugin upload/import functionality. An authenticated administrator could upload a specially crafted ZIP...

CVE-2026-2831 MailArchiver <= 4.5.0 - Authenticated (Admininistrator+) SQL Injection via 'logid' Parameter

The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2026-2831

CVE-2026-2831 affects the MailArchiver WordPress plugin (versions ≤ 4.5.0). It is an authenticated SQL Injection via the logid parameter, requiring Administrator-level access. Impact: potential extraction of sensitive data. Patch: fixed in 4.5.0; earlier versions are affected.

CVE-2026-28279

The CVE affects osctrl prior to v0.5.0, where an authenticated administrator can inject shell commands via the hostname in osctrl-admin environment configurations. The commands are embedded into enrollment one-liner scripts generated with Go's text/template (no shell escaping) and execute on ever...

CVE-2026-2498 WP Social Meta <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings

The WP Social Meta plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions...

CVE-2026-2489 TP2WP Importer <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea

The TP2WP Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Watched domains' textarea on the attachment importer settings page in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping when domains are saved via...

CVE-2026-2489

CVE-2026-2489 concerns the WordPress plugin TP2WP Importer. It enables a stored cross-site scripting (XSS) vulnerability via the Watched domains textarea on the attachment importer settings page, affecting versions up to 1.1. The issue arises from insufficient input sanitization and output escapi...

WordPress TP2WP Importer plugin <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Watched domains' Textarea vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'Watched domains' Textarea vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin TP2WP Importer versions = 1.1...

WordPress WP Social Meta plugin <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Settings vulnerability discovered by Muhammad Nur Ibnu Hubab Ibnu - Pondok Teknologi in WordPress Plugin WP Social Meta versions = 1.0.1...

CVE-2026-20091 Cisco UCS Manager and FXOS Software Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of...

CVE-2026-20036

A vulnerability in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with valid administrative privileges to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to...