CVE-2026-94003: Stack-based Buffer Overflow

A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function getcsspathfromuri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been...

wechat-employee-assistant

Starting the Web Interface and Listening Process To start t...

CVE-2026-15463

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-11608 WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Open Web Analytics 1.7.3 - Remote Code Execution

Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '?php instead of the intended "?php sequence aren't handled by the PH...

PT-2026-95748

Name of the Vulnerable Software and Affected Versions Pochipp versions prior to 1.20.3 Description The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs because the application...

CVE-2026-86591: Missing Authorization

The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full site takeover. The same route also allo...

PT-2026-95900

Name of the Vulnerable Software and Affected Versions Comfast CF-N1-S version 2.6.0.1 Description The Web Management Interface contains a stack-based buffer overflow that can be triggered remotely. The issue exists within the get css path from uri function located in the /cgi-bin/mbox-config...

MAL-2026-16292 Malicious code in @shared-web/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5425b12d827e5327939280ed16ddd0a613b28d0d728a0a8b193f342a666c65e9 package.json declares scripts.install: node index.js, which loads lib/core.js. On npm install, that module reads os.userInfo.username, os.hostname, a...

Malicious code in @shared-web/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5425b12d827e5327939280ed16ddd0a613b28d0d728a0a8b193f342a666c65e9 package.json declares scripts.install: node index.js, which loads lib/core.js. On npm install, that module reads os.userInfo.username, os.hostname, a...

CVE-2026-84108

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84106

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84031

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84070

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84074

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-82890

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary JavaScript code due to improper neutralization of input during web page generation...

CVE-2026-84108 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation...

EUVD-2026-83359

IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-84108

IBM Guardium Data Protection 12.2 is vulnerable to remote code execution caused by improper neutralization of input during web page generation. A remote attacker with no privileges and no user interaction could exploit this via the network, though with high attack complexity. The assigned CVSS 3....

CVE-2026-84106

IBM Guardium Data Protection 12.2 is affected by a vulnerability that could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation . The CVSS v3.1 score is 8.9 (HIGH) , with a changed scope and high impact on both confide...