16320 matches found
CVE-2026-15706: Missing Authentication for Critical Function
Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...
PT-2026-79004
Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...
PT-2026-78990
Name of the Vulnerable Software and Affected Versions Smart Cleaning versions prior to 4.8.7 Description An arbitrary file upload issue exists that allows users with subscriber privileges to upload unauthorized files to the system. Recommendations Update to a version newer than 4.8.6...
CVE-2026-74016: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Smart Cleaning = 4.8.6 versions...
CVE-2026-73185
Unauthenticated SQL Injection in NGG Smart Image Search 4.0.0 versions...
CVE-2026-73185 WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in NGG Smart Image Search 4.0.0 versions...
CVE-2026-73185 WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in NGG Smart Image Search 4.0.0 versions...
CVE-2026-73185
The WordPress NGG Smart Image Search plugin (versions
EUVD-2026-62380
Unauthenticated SQL Injection in NGG Smart Image Search 4.0.0 versions...
Malicious code in @wizloft/harness (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3679ede1e874f59f4be963544c3df43069cd335b2f888753b7411e42c7a5d3dd dist/index.js — the package's main/exports entrypoint — presents 200 lines of TypeScript-compiled SDK facade followed by a single 40KB line of...
MAL-2026-14285 Malicious code in @wizloft/harness (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3679ede1e874f59f4be963544c3df43069cd335b2f888753b7411e42c7a5d3dd dist/index.js — the package's main/exports entrypoint — presents 200 lines of TypeScript-compiled SDK facade followed by a single 40KB line of...
WordPress NGG Smart Image Search plugin < 4.0.0 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Jarno Vos jrn5151 in WordPress Plugin NGG Smart Image Search versions 4.0.0...
PT-2026-78336
Name of the Vulnerable Software and Affected Versions NGG Smart Image Search versions prior to 4.0.0 Description An unauthenticated SQL Injection exists in the software. SQL Injection is a type of vulnerability that allows an attacker to interfere with the queries that an application makes to its...
CVE-2026-73185: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in NGG Smart Image Search 4.0.0 versions...
GO-2026-6182 Command execution via PowerShell smart quotes in github.com/rclone/rclone
PowerShell treats several Unicode smart-quote characters U+2018, U+2019, U+201A, U+201B as single-quote delimiters in addition to ASCII apostrophe. When interpolating remote SFTP paths into PowerShell commands, rclone only escapes the ASCII apostrophe, allowing an attacker to craft a filename wit...
CVE-2026-32473
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
CVE-2026-32473 WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
CVE-2026-32473 WordPress PDF Smart Viewer for Elementor plugin <= 1.0.4 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
CVE-2026-32473
The "pdf-smart-viewer-for-elementor" WordPress plugin (versions ≤ 1.0.4) allows unauthenticated attackers to force server-side HTTP requests, enabling internal network access or metadata probing. CVSS 7.2 (HIGH) reflects network access with low impact. No exploitation observed; update to a patche...