CVE-2026-34888: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Bricksforge = 3.1.8.4 versions...

CVE-2026-27870: Improper Neutralization of Input During Web Page Generation

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat in this case, registration action IS required who has the vulnerable software could, introduce arbitrary JavaScript by injecting a Cross-site Scripting XSS payload into the 'Hostname' field of the configuration...

CVE-2026-27410: Deserialization of Untrusted Data

Unauthenticated Deserialization of untrusted data in Slimstat Analytics 5.4.0 versions...

CVE-2026-27400: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Deletion in BookPro = 1.1.0 versions...

CVE-2026-27395: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Support Board 3.8.9 versions...

CVE-2026-24611: Missing Authorization

Unauthenticated Broken Access Control in MetForm Pro = 3.9.1 versions...

CVE-2026-22339: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WPJobster = 6.3.5 versions...

WordPress Plugin: wc-frontend-manager-ultimate: CVE-2026-22335: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...

CVE-2026-22332: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Tutor LMS Pro = 3.9.6 versions...

CVE-2026-22331: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in AutoParts = 1.5.8 versions...

CVE-2026-22330: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Right Way = 4.0 versions...

CVE-2026-22329: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Skillate = 1.2.10 versions...

CVE-2026-22326: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Reprizo = 1.0.8 versions...

CVE-2026-22325: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Promo = 1.3.0 versions...

CVE-2026-10837: URL Redirection to Untrusted Site

Open redirection vulnerability due to insufficient validation of the X-Forwarded-Host HTTP header. An attacker could create manipulated links that, when opened by a victim, cause the victim to be redirected to domains controlled by the attacker, enabling phishing or deception attacks with limited...

CVE-2026-10836: Improper Neutralization of HTTP Headers for Scripting Syntax

Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using specially crafted requests. A successful exploit could result in the generation of manipulated links or responses, potentially leading to limited information disclosure or compromising...

CVE-2026-0083: Undefined Security Weakness

In Nfc::eventCallback of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0082: Undefined Security Weakness

In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0064: Undefined Security Weakness

In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0063: Undefined Security Weakness

In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...