PT-2026-2914

Name of the Vulnerable Software and Affected Versions Orchestrator affected versions not specified Description A flaw exists in the Orchestrator service that may allow a remote attacker who does not have an account to circumvent multi-factor authentication. Exploitation of this issue could lead t...

CVE-2025-67833

CVE-2025-67833 affects Paessler PRTG Network Monitor and is an XSS vulnerability. Versions prior to 25.4.114 allow an unauthenticated attacker to execute script via the tag parameter. There is no exploitation detail provided beyond this description in the connected documents. Impact is cross-site...

PT-2026-2921

Name of the Vulnerable Software and Affected Versions Paessler PRTG Network Monitor versions prior to 25.4.114 Description A Cross-Site Scripting XSS issue exists in Paessler PRTG Network Monitor. An unauthenticated attacker can exploit this issue via the tag parameter. Recommendations Update...

EUVD-2026-2432

Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter...

CVE-2026-20875

Null pointer dereference in Windows Local Security Authority Subsystem Service LSASS allows an unauthorized attacker to deny service over a network...

CVE-2025-40805

Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Successful exploitation requires that the attacker has learned the identity of a...

CVE-2026-0500

Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager WorkStation, an unauthenticated attacker could create a malicious JNLP Java Network Launch Protocol file accessible by a public facing URL. When a victim clicks on the URL the accessed Wily Introscope...

PT-2026-2453

Name of the Vulnerable Software and Affected Versions AOS-8 operating system affected versions not specified Description A flaw exists in a system function of mobility conductors running the AOS-8 operating system that allows for arbitrary file deletion. A remote attacker could exploit this to...

PT-2026-2351

Name of the Vulnerable Software and Affected Versions versions prior to 2025-41717 Description An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of...

Inbit Messenger 安全漏洞

Inbit Messenger is an instant messaging suite for corporate intranets from Inbit. A security vulnerability exists in Inbit Messenger versions 4.6.0 through 4.9.0, which stems from a protocol stack overflow that could allow an unauthenticated attacker to execute arbitrary commands...

SAP Business Connector 跨站脚本漏洞

SAP Business Connector is a middleware from SAP, Germany. A cross-site scripting vulnerability exists in SAP Business Connector that originates in cross-site scripting and could allow an unauthenticated attacker to craft a malicious link to redirect users to a site under the attacker's control,...

SAP Supplier Relationship Management 输入验证错误漏洞

SAP Supplier Relationship Management SRM is a supplier relationship management solution from SAP. The product automates purchasing and acquisition processes within an organization and between suppliers, and provides functionality such as invoicing. An input validation error vulnerability exists i...

PT-2026-2345

Name of the Vulnerable Software and Affected Versions SAP Business Connector affected versions not specified Description A Cross-Site Scripting XSS issue exists in SAP Business Connector. An unauthenticated attacker can create a malicious link. If a user clicks this link, they may be redirected t...

CVE-2026-22781

TinyWeb is a web server HTTP, HTTPS written in Delphi for Win32. TinyWeb HTTP Server before version 1.98 is vulnerable to OS command injection via CGI ISINDEX-style query parameters. The query parameters are passed as command-line arguments to the CGI executable via Windows CreateProcess. An...

CVE-2025-14976 User Registration & Membership <= 4.4.8 - Cross-Site Request Forgery to Arbitrary Post Deletion

The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.8. This is due to missing or incorrect nonce...

EUVD-2026-1857

The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.4.8. This is due to missing or incorrect nonce...

WordPress plugin miniOrange OTP Verification and SMS Notification for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

CVE-2025-67070

A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the multi-factor authentication MFA mechanism during the password recovery process. This results in the ability to change the admin password and gain full access to th...

CVE-2025-13761

A flaw was found in GitLab. This Cross-Site Scripting XSS vulnerability allows an unauthenticated attacker to execute arbitrary code in the context of an authenticated user's browser. This occurs when a legitimate user is convinced to visit a specially crafted webpage, potentially leading to...

CVE-2026-22198

GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting XSS vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value for example, to /api/v1/ticket.php, an unauthenticated attacker can cause...