EUVD-2026-1485

OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files...

CVE-2026-22232

OPEXUS eCASE Audit contains a stored cross-site scripting vulnerability in the Project Setup function. An authenticated attacker can save JavaScript in the “A or SIC Number” field, which is then executed when another user views the project. This affects the eCASE Audit component prior to version ...

CVE-2026-22232 OPEXUS eCASE Audit Project Setup stored XSS

OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is executed whenever another user views the project. Fixed in OPEXUS eCASE Audit 11.14.2.0...

EUVD-2026-1498

Missing Authorization vulnerability in Hakob Re Gallery & Responsive Photo Gallery Plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Re Gallery & Responsive Photo Gallery Plugin: from n/a through 1.17.18...

EUVD-2026-1480

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in G5Theme Handmade Framework allows PHP Local File Inclusion.This issue affects Handmade Framework: from n/a through 3.9...

CVE-2025-11246

creationtimestamp| type| source ---|---|--- 2026-01-08 14:15:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mbw66qsi4d2u 2026-01-09 12:39:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbyjc4xatv2u...

EUVD-2026-1455

A flaw was found in Ansible Automation Platform AAP. Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services e.g., Controller, Hub, EDA. If thi...

EUVD-2026-1567

A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected installations. Please note: authentication is not required in order to exploit this vulnerability...

CVE-2025-14358

creationtimestamp| type| source ---|---|--- 2026-01-08 11:10:42+00:00| seen| https://gist.github.com/Darkcrai86/0f2f091b398e976b070c08d02729cf54 2026-01-08 18:12:54+00:00| seen| Telegram/EtPMuYPkez1urTV-f9PU12-wdM8HozF7eLvC6FzMc5P0Qh8 2026-01-08 18:13:20+00:00| seen|...

EUVD-2026-1519

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hands01 e-shops e-shops-cart2 allows DOM-Based XSS.This issue affects e-shops: from n/a through = 1.0.4...

EUVD-2026-1503

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jcaruso001 Flaming Password Reset flaming-password-reset allows Stored XSS.This issue affects Flaming Password Reset: from n/a through = 1.0.3...

EUVD-2026-1510

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Based XSS.This issue affects Effect Maker: from n/a through = 1.2.1...

EUVD-2026-1543

Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through = 2.3.8...

EUVD-2026-1556

Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Aruba HiSpeed Cache: from n/a through 3.0.3...

EUVD-2026-1551

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows SQL Injection.This issue affects WooCommerce Orders & Customers Exporter: from n/a through = 5.4...

RHSA-2026:0225

creationtimestamp| type| source ---|---|--- 2026-01-08 07:59:53+00:00| seen| https://gist.github.com/Darkcrai86/599f72da8d906520e6ed3c9912224929...

RHSA-2026:0233

creationtimestamp| type| source ---|---|--- 2026-01-08 07:58:01+00:00| seen| https://gist.github.com/Darkcrai86/fbdf20b19e12fdac7917ef429b8a06b9...

RHSA-2026:0237

creationtimestamp| type| source ---|---|--- 2026-01-08 07:57:35+00:00| seen| https://gist.github.com/Darkcrai86/da7e4d18ae3b88e2895c98c0d51ae1b2...

CVE-2025-13679 Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getorderbyid function in all versions up to, and including, 3.9.3. This makes it possible for authenticated attackers, with...

kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue

A flaw was discovered in the Bluetooth subsystem of the Linux kernel. When processing a HCIEVNUMCOMPPKTS event, the function hciconntxdequeue did not properly hold or release the hdev device lock, which may lead to a use-after-free of the connection structure...