PT-2026-2174

Name of the Vulnerable Software and Affected Versions OPEXUS eCASE Audit versions prior to 11.14.2.0 Description OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the “A or SIC Number” field within the Project Setup functionality. This JavaScript is executed when another...

EUVD-2026-1451

KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 allow authentication bypass during session validation. If any user is logged in, endpoints such as /cgi-bin/system-tool accept unauthenticated requests with empty or invalid session values. This design flaw lets attackers piggyback on another user'...

EUVD-2026-1172

An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS responses, can redirect the SSH connection to an attacker...

CVE-2026-22544

creationtimestamp| type| source ---|---|--- 2026-01-07 18:07:02+00:00| seen| Telegram/BnTAIC0iodkqMq4D8miTs1BNlTWY2vPbrNPo5ViH8Dm-XRI 2026-01-07 18:12:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbu2xpqw3m2u...

EUVD-2026-1175

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39...

EUVD-2026-1203

The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictions...

EUVD-2026-1198

An attacker with a network connection could detect credentials in clear text...

EUVD-2026-1208

The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating correctly for the charger to also function correctly...

CGA-P8WC-28G2-VQM9

Bulletin has no description...

EUVD-2026-1225

Kieback&Peter Neutrino-GLT product is used for building management. It's web component "SM70 PHWEB" is vulnerable to shell command injection via login form. The injected commands would execute with low privileges. The vulnerability has been fixed in version 9.40.02...

EUVD-2026-1223

Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor Pro: from n/a before 6.3.7...

EUVD-2026-1234

Not used...

EUVD-2026-1248

EUVD-2026-1248...

EUVD-2026-1259

EUVD-2026-1259...

EUVD-2026-1240

EUVD-2026-1240...

EUVD-2026-1253

Missing Authorization vulnerability in Crocoblock JetEngine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.8.1.1...

EUVD-2026-1261

Missing Authorization vulnerability in ThemeHunk Oneline Lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: from n/a through 6.6...

CVE-2025-14122

creationtimestamp| type| source ---|---|--- 2026-01-07 11:13:45+00:00| seen| https://gist.github.com/Darkcrai86/77cc5e0eee11bd356f4396bc8c08276b...

CVE-2025-1400

Out-of-bounds Read vulnerability in unpackresponse conn.c in libplctag from 2.0 through 2.6.3 allows Overread Buffers via network...

CVE-2025-1880

A vulnerability was found in i-Drive i11 and i12 up to 20250227. It has been classified as problematic. Affected is an unknown function of the component Device Pairing. The manipulation leads to authentication bypass by primary weakness. It is possible to launch the attack on the physical device...