EUVD-2026-50954

A format string vulnerability was found in the Internal Backup on the ADM. The vulnerability occurs because user-controlled task input may be included in an error response and processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory...

EUVD-2026-50957

A stored format string vulnerability was found in the FTP Backup on the ADM. The vulnerability occurs because user-controlled backup configuration data may be written into a task log and later processed through an unsafe format string operation. An authenticated attacker can exploit this issue to...

CVE-2026-54727

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a...

CVE-2026-54727

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a...

UNIX Symbolic Link (Symlink) Following

Overview proot-distro is a PRoot-Distro is a lightweight rootless Linux container management utility built around proot. Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the prootdistro/commands/install.py function and the equivalent process in...

CVE-2026-67213

nanoid Nano ID before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that...

CVE-2015-8778

creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:46+00:00| seen| Telegram/nEfx4bkJlcldrL4ooYbVX-cKtKfFWPCKK6-GEAcf7FF 2026-07-30 00:02:02+00:00| seen| Telegram/nEfx4bkJlcldrL4ooYbVX-cKtKfFWPCKK6-GEAcf7FF 2026-08-01 15:00:04+00:00| seen|...

PT-2026-65811

Name of the Vulnerable Software and Affected Versions anoid Nano ID versions prior to 5.1.6 Description The customAlphabet and customRandom functions contain an infinite loop. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and...

PT-2026-65834

Name of the Vulnerable Software and Affected Versions AMMOS Instrument Toolkit AIT GUI versions prior to 2.5.1 Description An authentication flaw allows an unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands. This is possible by calling the...

CVE-2026-61957

Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...

EUVD-2026-49228

Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

CVE-2026-65460

Unauthenticated Cross Site Request Forgery CSRF in Zarinpal Gateway = 5.1.0 versions...

CVE-2026-1617

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama allows SQL Injection. This issue affects Turkhotspot 5651 Loglama: from 5.1.2 before 5.1.3...

CVE-2026-47198 Paymenter: URL parameter injection bypasses paid plan limits at checkout

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters URL-writable properties, allowing authenticated users to inject arbitrary key-value pairs into server provisioning parameters. Because...

CVE-2026-13001 Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlovehandlecachefiles' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on t...

CVE-2026-57803

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion. This issue affects Struktur Core: from n/a before 2.7...

CVE-2026-57695

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through = 5.1.0...

CVE-2026-57802 WordPress Struktur theme < 2.7 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Select-Themes Struktur allows PHP Local File Inclusion. This issue affects Struktur: from n/a before 2.7...

CVE-2026-57797 WordPress EduMall theme <= 4.5.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduMall: from n/a through = 4.5.1...

EUVD-2026-43406

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in jwsthemes Aqua aqua allows PHP Local File Inclusion.This issue affects Aqua: from n/a through = 5.1.2...