CVE-2026-10207

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash which removes...

CVE-2026-16462

The CVE concerns PROCON-WEB SCADA: the GetGridData endpoint is not properly sanitized, enabling a remote unauthenticated attacker to execute arbitrary SQL commands (SQL injection). This vulnerability has a CVSS 3.1/3.1 base score 9.8 (CRITICAL) and CVSS 4.0 score 9.3, indicating high impact to co...

EUVD-2026-49733

In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands...

EUVD-2026-49732

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access witho...

CVE-2026-11841

CVE-2026-11841 describes unauthenticated read/write access to sensitive filesystem areas via AppEngine Fileaccess over HTTP due to improper access controls. The vulnerability exposes a critical filesystem directory, enabling reading and modification of application settings (including customer pas...

CVE-2026-15267

The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppmprojfilter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of...

CVE-2026-44387

ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-61376

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-9680

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default...

CVE-2026-13161

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...

CVE-2026-14168

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access...

CVE-2026-14516

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2026-64255

A flaw was found in the Linux kernel's iwlwifi Intel Wireless WiFi driver. This vulnerability allows an attacker to cause an out-of-bounds memory access in the WiFi Block Acknowledgement BA session handlers. This occurs when the stamask value is zero, leading to an incorrect station ID calculatio...

CVE-2026-14171 ads-tec Industrial IT: Post-login open redirect in the web interface

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability...

CVE-2026-14169

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...

CVE-2026-14168 ads-tec Industrial IT: Vertical privilege escalation via configuration table write

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access...

CVE-2026-14168

A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access...

CVE-2026-14168

The CVE CVE-2026-14168 affects ads-tec Industrial IT, with a root cause described as missing authorization at the insert path of the configuration table. This allows a low-privileged remote attacker to escalate to administrator privileges, resulting in full system access. The available documents ...

CVE-2026-14167

A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization...

CVE-2026-9680 MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default...