EUVD-2026-24541

WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for objects/aVideoEncoderReceiveImage.json.php only checks the URL path component via parseurl$url, PHPURLPATH for .. sequences. However, the downstream function...

CVE-2026-41056 AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover

WWBN AVideo is an open source video platform. In versions 29.0 and below, the allowOrigin$allowAll=true function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This function is called by both...

CVE-2026-34990 affecting package cups for versions less than 2.4.17-1

CVE-2026-34990 affecting package cups for versions less than 2.4.17-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-27447 affecting package cups for versions less than 2.4.17-1

CVE-2026-27447 affecting package cups for versions less than 2.4.17-1. An upgraded version of the package is available that resolves this issue...

WordPress WooCommerce PDF Invoices & Packing Slips plugin < 5.9.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by daroo in WordPress Plugin WooCommerce PDF Invoices & Packing Slips versions 5.9.0...

WordPress WpStream plugin < 4.11.2 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Muhammad Sharief in WordPress Plugin WpStream versions 4.11.2...

CVE-2026-35469 affecting package containerd2 for versions less than 2.0.0-19

CVE-2026-35469 affecting package containerd2 for versions less than 2.0.0-19. A patched version of the package is available...

CVE-2026-33056 affecting package rust for versions less than 1.75.0-28

CVE-2026-33056 affecting package rust for versions less than 1.75.0-28. A patched version of the package is available...

CVE-2025-69652 affecting package binutils for versions less than 2.41-11

CVE-2025-69652 affecting package binutils for versions less than 2.41-11. A patched version of the package is available...

CVE-2026-3494 affecting package mariadb for versions less than 10.6.25-1

CVE-2026-3494 affecting package mariadb for versions less than 10.6.25-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-29111 affecting package systemd for versions less than 250.3-24

CVE-2026-29111 affecting package systemd for versions less than 250.3-24. A patched version of the package is available...

CVE-2025-2915 affecting package hdf5 for versions less than 1.14.6-2

CVE-2025-2915 affecting package hdf5 for versions less than 1.14.6-2. A patched version of the package is available...

EUVD-2025-209433

MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthenticated attacker to perform actions in the name of other users and using their privileges...

CVE-2026-27668

CVE-2026-27668 affects RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) with all versions below v5.8. The issue allows an authenticated User Administrator to escalate their own privileges by administering groups they belong to, enabling access to any device group at any access level. Docu...

CVE-2026-24032

A vulnerability has been identified in SINEC NMS All versions V4.0 SP3 with UMC. The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component. This could allow an unauthenticated remote attacker to bypass authentication and gain...

CVE-2026-35388 affecting package openssh for versions less than 9.8p1-6

CVE-2026-35388 affecting package openssh for versions less than 9.8p1-6. A patched version of the package is available...

CVE-2026-21716 affecting package nodejs24 for versions less than 24.14.1-1

CVE-2026-21716 affecting package nodejs24 for versions less than 24.14.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-25203

Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: less than 21.1091.1...

CVE-2026-25203

Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: less than 21.1091.1...

📄 FortiWeb 8.0.1 Remote Code Execution

FortiWeb remote code execution exploit that affects versions prior to 7.6.7, 7.8.7, and 8.0.2. Exploit Title: FortiWeb 8.0.2 - Remote Code Execution Date: 2025-11-22 Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram: @banyamersecurity GitHub: https://github.com/mbanyamer Vendor...