Leawo Prof. Media security vulnerabilities

Leawo Prof. Media is a multimedia toolkit developed by Leawo Corporation. Version 11.0.0.1 of Leawo Prof. Media contains a security vulnerability, which stems from an excessively large payload in the activation key code field. This vulnerability could lead to denial-of-service attacks...

PT-2026-3211

The Awesome Support - WordPress HelpDesk & Support Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in all versions up to, and including, 6.3.6. This is due to the 'wpas do mr activate user' function not verifying that a user has permission to modify oth...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004782)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004782 advisory. Guests can trigger deadlock in Linux netback driver This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond ...

CVE-2021-47797 Leawo Prof. Media 11.0.0.1 - Denial of Service (DoS) (PoC)

Leawo Prof. Media 11.0.0.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized payload in the activation keycode field. Attackers can generate a 6000-byte buffer of repeated characters to trigger an application crash when pasted into...

CVE-2021-47797

Leawo Prof. Media 11.0.0.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized payload in the activation keycode field. Attackers can generate a 6000-byte buffer of repeated characters to trigger an application crash when pasted into...

CVE-2021-47797 Leawo Prof. Media 11.0.0.1 - Denial of Service (DoS) (PoC)

Leawo Prof. Media 11.0.0.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized payload in the activation keycode field. Attackers can generate a 6000-byte buffer of repeated characters to trigger an application crash when pasted into...

CVE-2021-47797

CVE-2021-47797 concerns Leawo Prof. Media 11.0.0.1. A DoS vulnerability in the activation keycode handling allows an oversized payload (6000-byte, repeated characters) to crash the application when pasted into the registration interface. The CVE references PoC material in multiple sources. No pat...

PT-2026-3169

Leawo Prof. Media 11.0.0.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized payload in the activation keycode field. Attackers can generate a 6000-byte buffer of repeated characters to trigger an application crash when pasted into...

TencentOS Server 3: python39:3.9 (TSSA-2025:1001)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:1001 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

WOW21 代码问题漏洞

WOW21 is an unofficial Windows Office activation software by ilwebmaster Personal Developer. A code issue vulnerability exists in WOW21 version 5.0.1.9, which stems from the presence of unquoted service paths that could allow a local attacker to execute arbitrary code with elevated system...

MiracleLinux 7 : python3-3.6.8-21.0.3.el7.AXS7 (AXSA:2025-9726:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9726:01 advisory. - CVE-2024-9287: fix path names quoting to prevent command injection in virtual environment activation scripts CVEs: CVE-2024-9287 A vulnerability has been...

CVE-2023-31115

An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300. Incorrect resource transfer between spheres can cause changes to the activation mode of RCS via a crafted application...

CVE-2009-4851

The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php...

CVE-2016-10765

edx-platform before 2016-06-10 allows account activation with a spoofed e-mail address...

CVE-2023-4600

The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwpactivateaddonspageplugin' function called via an AJAX action in versions up to, and including, 2.14.0. This makes it possible for authenticated attackers, with...

CVE-2023-4478

Mattermost fails to restrict which parameters' values it takes from the request during signup allowing an attacker to register users as inactive, thus blocking them from later accessing Mattermost without the system admin activating their accounts...

CVE-2023-40201

Cross-Site Request Forgery CSRF vulnerability in FuturioWP Futurio Extra plugin = 1.8.4 versions leads to activation of arbitrary plugin...

CVE-2019-7357

Subrion CMS 4.2.1 has CSRF in panel/modules/plugins/. The attacker can remotely activate/deactivate the plugins...

CVE-2019-12361

EmpireCMS 7.5.0 has XSS via the from parameter to e/member/doaction.php, as demonstrated by a CSRF payload that changes the dynamic page template. The attacker can choose to resend the e/template/member/regsend.php registered activation mail page...

ThreatsDay Bulletin: GhostAd Drain, macOS Attacks, Proxy Botnets, Cloud Exploits, and 12+ Stories

The first ThreatsDay Bulletin of 2026 lands on a day that already feels symbolic — new year, new breaches, new tricks. If the past twelve months taught defenders anything, it's that threat actors don't pause for holidays or resolutions. They just evolve faster. This week's round-up shows how subt...