EUVD-2026-103227

The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.8 This is due to missing or incorrect...

EUVD-2026-103219

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...

CVE-2026-110268 Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...

CVE-2026-110268 Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' Parameter

The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.2 via the 'themeslug' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to perform actions on files outsid...

CVE-2026-110268

The Post Export Import with Media plugin for WordPress is vulnerable to a Directory Traversal (CWE-22) vulnerability in all versions up to and including 1.17.2 . The flaw exists in the 'theme_slug' parameter, allowing authenticated attackers with administrator-level access or higher to access or ...

CVE-2026-77991

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-77991 CVE-2026-77991 JEM - Joomla Event Manager 5.0.0 - joomlaeventmanager.net I am @abraxasnull. Loopback lab. The client is CVE-2026-77991-Abraxas-Labs.py. The advisory named a model. Privileged RCE:...

BMC Helix Network Management Authentication Bypass

BMC Helix Network Management versions before 26.3.01 contain an authentication bypass when SAML-based single sign-on is configured, allowing the local administrator account to authenticate with any password...

Linux Distros Unpatched Vulnerability : CVE-2026-110111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the...

CVE-2023-7028

CVE-2023-7028 Exploit - GitLab Password Reset Poisoning Vulnerability Overview This repository contains an exploit for CVE-2023-7028 , a critical vulnerability in GitLab that allows an attacker to abuse the password reset functionality and take over accounts, including administrator accounts...

CVE-2026-37068

CVE-2026-37068 Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected...

CVE-2026-111693

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator...

CVE-2026-111643

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter...

CVE-2026-111619

FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and...

CVE-2026-111693

The DataBuff ai-apm-web application (versions through 0.1.10 ) is vulnerable to a hard-coded default credentials vulnerability (CWE-1392 ). Unauthenticated attackers can gain administrator access by sending a POST request with the built-in account admin/Databuff@123 to the /webapi/api/v1/auth/log...

EUVD-2026-102984

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator...

EUVD-2026-103065

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter...

CVE-2026-111643

The Misaka Danmu Server (versions through 2.8.9 ) contains an authentication bypass vulnerability (CWE-306) due to an unprotected POST /api/ui/config-history/rollback endpoint. This flaw allows unauthenticated attackers to write arbitrary configuration keys. Specifically, attackers can modify the...

EUVD-2026-103058

OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default appsecret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenantdemo' to gain full tena...

CVE-2026-111619

FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and...

CVE-2026-111619

The FilePress software, versions through 3.0.1 , is vulnerable to an SQL Injection flaw. Authenticated low-privilege users can inject SQL into ORDER BY clauses by exploiting the unvalidated asc parameter in dzz/pichome/library/filelist.php and dzz/collection/filelist.php. This allows attackers to...