CVE-2026-67854

Qcms v6.0.6 is affected by a SQL Injection vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code. The vulnerability is rated CVSS 9.8 (Critical) with a network attack vector, low complexity, and no required privileges or user interaction, resulting in high impact ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: redis (UTSA-2026-100781)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100781 advisory. Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK...

CVE-2026-68004

An issue in OSSRS SRS Simple Realtime Server v5.0.213 allows a remote attacker to execute arbitrary code via RTMP publish authorization, vhost-level security configuration security.enabled, SrsSecurity::check, trunk/src/app/srsappsecurity.cpp, and SRS RTMP listener components...

ROS-20260817-73-0216

The vulnerability in Ruby is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

ROS-20260817-73-0215

The vulnerability in Ruby is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Apache Solr <=8.3.1 - Remote Code Execution

Apache Solr versions 5.0.0 to 8.3.1 are vulnerable to remote code execution vulnerabilities through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable,...

MINI-Q4C3-FFQV-PX2F

Bulletin has no description...

MINI-MR7M-M89X-FV5V

Bulletin has no description...

Hack-The-Box-Connected-Full-Machine-Walkthrough

Hack The Box — Connected Platform: Hack The Box Mac...

Exploit for Insertion of Sensitive Information into Log File in Hitachi Configuration_Manager

cve-2025-5781FreePBX In August 2025, a critical vulnerabilit...

CVE-2026-17087

creationtimestamp| type| source ---|---|--- 2026-08-16 08:00:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mt6psdpf6i22 2026-08-16 10:16:12+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mt6xfvz76g2p...

MINI-WXV4-7QWW-MFWX

Bulletin has no description...

MINI-49GV-CXQP-PPPM

Bulletin has no description...

CVE-2026-17581

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

CVE-2026-17581

The CVE concerns the WCPOS – Point of Sale (POS) plugin for WooCommerce (WordPress). Affected versions: up to 1.9.14. Root cause: the Receipt_Renderer_Factory dispatches templates using the thermal engine to the Legacy_Php_Renderer instead of a safe thermal-specific renderer, enabling Code Inject...

CVE-2026-17581 WCPOS <= 1.9.14 - Authenticated (Shop Manager+) Code Injection via 'thermal' Template Engine

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

EUVD-2026-59905

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

CVE-2026-17581

The WCPOS – Point of Sale POS plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engine in all versions up to, and including, 1.9.14 due to the ReceiptRendererFactory dispatching templates with the 'thermal' engine to the LegacyPhpRenderer inste...

CVE-2026-16098

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSolhandleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the...

CVE-2026-14498

The Query Wrangler plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.5.57 via the 'options' parameter parameter. This is due to missing capability check and nonce verification on the wpajaxqwformajax handler, combined with unsanitized...