CVE-2026-45215: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Retrieve Embedded Sensitive Data.This issue affects WP EasyPay: from n/a through = 4.3.0...

CVE-2026-32684: Incorrect Permission Assignment for Critical Resource

The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensitive information...

CVE-2026-27662: Initialization of a Resource with an Insecure Default

Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security mechanisms are in place. This could allow an unauthenticated attacker to gain unauthorized access to the web browser, potentially enabling the discovery of backdoors, performin...

CVE-2025-6577: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Akilli Commerce Software Technologies Ltd. Co. E-Commerce Website allows SQL Injection. This issue affects E-Commerce Website: before 4.5.001...

CVE-2026-39432: Missing Authorization

Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics: from n/a through 1.0.53...

CVE-2026-41713: Improper Neutralization of Special Elements Used in a Template Engine

A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns...

CVE-2026-32204: External Control of File Name or Path

External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-8108: Exposed Dangerous Method or Function

The installation of Fuji Tellus adds a driver to the kernel which grants all users read and write permissions...

CVE-2026-41895: Improper Restriction of XML External Entity Reference

changedetection.io is a free open source web page change detection tool. In 0.54.9 and earlier, xpathfilter switches to XML mode for XML/RSS content and creates etree.XMLParserstripcdata=False without explicitly disabling external entity resolution, external DTD loading, or network-backed entity...

CVE-2026-40414: NULL Pointer Dereference

Windows TCP/IP Denial of Service Vulnerability...

CVE-2026-40408: Use After Free

Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally...

CVE-2026-33841: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally...

CVE-2026-30810: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pandora FMS: from 777 through 800...

CVE-2026-30808: Session Fixation

Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777 through 800...

CVE-2026-6866: Initialization of a Resource with an Insecure Default

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials revert to initial settings in rare circumstances, enabling unauthorized authentication using known credentials...

CVE-2026-42006: Uncontrolled Resource Consumption

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomplete, only blocking one way of doing this, so there was still another way left open. In particular, the fix was for closing braces, but you could still use open braces to bypass t...

CVE-2026-2465: Incorrect Authorization

Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd. Co. Turboard FOR-S allows Privilege Escalation. This issue affects Turboard FOR-S: from 7.01.2026 before 18.02.2026...

CVE-2026-41551: Relative Path Traversal

A vulnerability has been identified in ROS All versions V2.2.2. Affected versions contain a path traversal vulnerability because user input is not properly sanitized. This could allow a remote attacker to access arbitrary files on the device...

CVE-2026-25789: Improper Neutralization of Input During Web Page Generation

Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote attacker to social engineer the user into selecting the modified firmware file to be uploaded. This would result in malitcious JavaScript execution in the context of the...

CVE-2026-25786: Improper Neutralization of Input During Web Page Generation

Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authorized to download a TIA project into the product, to inject malicious scripts into the page. If a...