CVE-2026-43946

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue...

CVE-2026-43946 FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue...

CVE-2026-65048

Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9 contains an unauthenticated stored cross-site scripting vulnerability in the Repeatable Fieldset feature where parseSubmissionIndex accepts arbitrary strings as submission indexes without numeric validation, and adminformelement...

CVE-2026-15145

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for...

MAL-2026-10977 Malicious code in lebinfmt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 448ec8ad7c978d60f142f12780be3bb6ae7b90870fa4c2bf2d50ca7d4111cdfd This package is prepared to perform steganography decoding using the same code and was published on the same day as package 'rasterkit,' later used to deliver...

MAL-2026-10974 Malicious code in rasterkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a6eea31746baa37e55a76fec564eda1852839be005d53ae1e24bf2b9ea4c7875 This package is a clone of Pillow library with malicious code hidden in an image using steganography. The code is the used in a dependant package to install an...

MAL-2026-10975 Malicious code in rasterkit-demo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 29eb6057bbc11a0f0180a030db952f9ec8aa39ce8c4b0d437046b20301f5b21a During import, the code uses steganography to extract code from an image hidden in the dependency. The code then adds a new authorized SSH key and reports back...

CVE-2026-15156 Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-16329

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photocenter/php/uploadify.php. The manipulation of the argument Malicious Handler leads to unrestricted upload. The attack may be initiated remotely. The exploit is publicly available and might be...

CVE-2026-16330

A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=fromcopylink causes unrestricted upload. Remote...

EUVD-2026-46137

A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=fromcopylink causes unrestricted upload. Remote...

PT-2026-61824

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-16327 D-Link DNS-320 upload.php unrestricted upload

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/webfile/upload.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack can be launched remotely. The exploit has been publicly disclosed and m...

EUVD-2026-42336

Mistune renderers/html.safeurl: HARMFULPROTOCOLS list misses legacy and chained schemes that historically chain to javascript: execution...

CVE-2026-34239

Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by apiprotectcoursescripttrue, which means any authenticated user enrolled in a course student, teacher, DRH can reach it...

CVE-2026-50743

A CSRF vulnerability exists in the zone-include.php script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an...

CVE-2026-51027

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component...

busybox: BusyBox: Denial of Service via crafted AWK script

A flaw was found in BusyBox. This vulnerability, a stack overflow in the evaluate function, allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted AWK script. A Denial of Service attack can make the affected system or application unavailable to legitimate users...

CVE-2026-53405

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...

EUVD-2026-45956

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a Groovy scriptTask is imported and started, the Groovy...