CVE-2026-25901: Improper Neutralization of Input During Web Page Generation

Lack of output escaping leads to a XSS vector in the multilingual associations component...

CVE-2026-25900: Improper Neutralization of Input During Web Page Generation

Lack of output escaping leads to a XSS vector in the feed modules...

CVE-2026-8174: Cross-Site Request Forgery (CSRF)

Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery CSRF. This issue affects Zoho Mail wordpress plugin versions before 1.6.2...

CVE-2026-24590: Missing Authorization

Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23...

CVE-2026-8047: Improper Validation of Specified Quantity in Input

The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device...

CVE-2026-8046: Incorrect Authorization

The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges...

CVE-2026-35221: Improper Neutralization of Special Elements used in an SQL Command

Improperly built filter clauses lead to a SQL injection vulnerability in the search query for comfinder...

CVE-2026-8676: Authentication Bypass by Spoofing

An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond...

CVE-2026-24520: Missing Authorization

Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24...

CVE-2026-48900: Improper Access Control

An improper access check allowed low privileged users to edit the task types of existing scheduler tasks...

CVE-2026-48902: Cleartext Transmission of Sensitive Information

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set...

CVE-2026-48897: Improper Authentication

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

CVE-2026-44410: Use of a Cryptographic Primitive with a Risky Implementation

This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the designer's expectations, to carry out malicious attacks...

CVE-2026-39661: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magentech SW Core allows PHP Local File Inclusion. This issue affects SW Core: from n/a through 1.7.18...

CVE-2026-24638: Missing Authorization

Missing Authorization vulnerability in Webful Creations RepairBuddy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RepairBuddy: from n/a through 4.1121...

CVE-2026-44469: Incorrect Default Permissions

The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before...

CVE-2026-39655: Missing Authorization

Missing Authorization vulnerability in TeconceTheme Mayosis Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Mayosis Core: from n/a through 5.4.7...

CVE-2026-44468: Incorrect Default Permissions

The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation by forcing the deployment of arbitrary...

CVE-2026-48896: Improper Authentication

Insufficient state checks lead to a vector that allows to bypass 2FA checks...

Malicious code in muaddib-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8eea5d3ed390c4c82b5bfa89ac220f1d424fcaebe70fe71bbbe3bce66f0f48f package.json declares "loadash": "^1.0.0" as a runtime dependency. loadash is a well-known typosquat of lodash and is never required or imported...