VulnCheck KEV: CVE-2014-125130

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

VulnCheck KEV: CVE-2026-65761

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions...

CVE-2026-103766 ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter

ClipBucket v5 through 5.5.3-197 contains an sql injection vulnerability that allows authenticated users with admanageraccess permission to inject SQL via the delete parameter in adminarea/adsmanager.php. Attackers can supply time-based blind payloads concatenated into AdsManager::DeleteAd queries...

CVE-2026-27873

Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52...

CVE-2026-27873

Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52...

CVE-2026-27873

Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52...

CVE-2026-27873

Johnson Controls EasyIO FG is vulnerable to a Use of Hard-coded Credentials vulnerability (CWE-798) in versions before 2.0b52 . This flaw allows for password spraying attacks. No specific exploit details or remediation steps are provided in the documents.

CVE-2026-27874

: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-27874

: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. This issue affects EasyIO FS32: before 3.0b63...

EUVD-2026-91061

: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-27874

The Johnson Controls EasyIO FS32 software is affected by a Use of Hard-coded Credentials vulnerability (CWE-798) in versions prior to 3.0b63 . An attacker can exploit these hard-coded or default credentials to gain unauthorized access to the system. To remediate this issue, users should update Ea...

CVE-2026-27874

: Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-102666

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once...

CVE-2026-102666 Joyland AI hard-coded credentials for push notifications

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once...

CVE-2026-102666

The Joyland AI app contains hard-coded credentials for the GeTui push notification service . This vulnerability allows an attacker to access the GeTui REST API to send push notifications with arbitrary content to any individual user, specific groups, or the entire user base of the app. No specifi...

EUVD-2026-91023

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once...

CVE-2026-55232

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed...

Malicious code in spo365-graph (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 091649f7b927b27a5bd7a35b53784433050bf58e0dc11acc95316b650a13f60b SPO365-GRAPH presents itself as a SharePoint Online Graph client, but the shipped library module SPO365GRAPH/SPO365GRAPH.py consists entirely of stub...

CVE-2026-55232

The Vvveb CMS is vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918) prior to version 1.0.8.6 . The root cause is an incomplete SSRF guard that uses an IPv4-only function , failing to inspect IPv6 addresses. Consequently, hosts lacking an A record bypass the private-range check. An authe...

EUVD-2026-91039

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's SSRF guard resolves a host with an IPv4-only function and never inspects IPv6, so any host that lacks an A record passes a private-range check. Editor oEmbed...