68749 matches found
CVE-2026-18191 Vacron｜IP Camera - Hidden Functionality
VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device...
EUVD-2026-50163
VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device...
CVE-2026-13423 Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
CVE-2026-13423
The Streamit WordPress theme (versions
CVE-2026-13423
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
CVE-2026-13423 Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
EUVD-2026-50115
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
PT-2026-65845
Name of the Vulnerable Software and Affected Versions ClickHouse Server versions prior to 26.3.9.8 Description A SQL Injection issue exists that allows a remote attacker to execute arbitrary code. The flaw is triggered through the create dictionaries function. Recommendations Update ClickHouse...
PT-2026-65770
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js to php function. This is due to insufficient sanitization of the orderDetails.originalValue field, which is injected verbatim into a calculator formul...
CVE-2026-51992
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. ClickHouse's PostgreSQL integration intentionally allows users with valid PostgreSQL credentials to execute queries against a remote PostgreSQL server. No vulnerability in ClickHouse is exploited; code execution occurs on...
CVE-2026-65891: Improper Input Validation
Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor JCE 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files t...
ROS-20260729-73-0011
The vulnerability in exim is related to errors in the representation of specified functions. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to protected information...
ROS-20260729-73-0013
The vulnerability in exim is related to errors in the representation of specified functions. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to protected information...
PT-2026-65862
Name of the Vulnerable Software and Affected Versions BlackBerry QNX affected versions not specified Description Improper input validation in the decode function of the traceparser library allows an attacker to use a corrupted kernel trace event log .kev file to execute arbitrary code or cause a...
The vulnerability of the recv_pkt() function in the net/bluetooth/6lowpan.c module of the Linux kernel’s Bluetooth subsystem allows a hacker to cause a service failure.
The vulnerability of the recvpkt function in the net/bluetooth/6lowpan.c module of the Linux Bluetooth subsystem is related to the improper disabling or release of resources. Exploiting this vulnerability could allow a malicious actor to cause service failure remotely...
PT-2026-65691
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
CVE-2026-13423: Improper Control of Generation of Code
The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...
PT-2026-65830
Name of the Vulnerable Software and Affected Versions Penelope versions prior to 0.20.0 Description The Unix download implementation in penelope.py fails to validate member paths when extracting tar archives received from remote sessions. A malicious or compromised session can return a crafted ta...
PT-2026-67508
Name of the Vulnerable Software and Affected Versions Sequelize versions prior to 6.37.4 Description SQL injection is possible when the dialect is set to oracle. The escape function in sql-string.js fails to escape single quotes if the input string starts with TO TIMESTAMP or TO DATE, returning t...