CVE-2026-23776

Dell PowerProtect Data Domain with Data Domain Operating System DD OS of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60, contains an Improper Certificate Validation vulnerability in...

CVE-2026-6451

The cms-fuer-motorrad-werkstaetten plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.0. This is due to missing nonce validation on all eight AJAX deletion handlers: vehiclescfmwdvehicle, contactscfmwdcontact, supplierscfmwdsupplier,...

EUVD-2026-23340

The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagramfollowtext' setting in all versions up to, and including, 1.7.1056 due to insufficient input sanitization and output escaping. This makes it possible for...

Anviz CX2 Lite 安全漏洞

The Anviz CX2 Lite is a smart terminal device from the American company Anviz, featuring integrated facial recognition and access control functions. The Anviz CX2 Lite has a security vulnerability; this vulnerability stems from the fact that management sessions are conducted via HTTP. This may...

xrdp 安全漏洞

XRDPT is an open-source remote desktop protocol server developed by Neutrinolabs. Versions of XRDPT prior to 0.10.5 contain security vulnerabilities. These vulnerabilities stem from issues with the session execution component’s handling of permission discarding processes. This could allow...

PT-2026-37019

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.4.10 Description An input validation issue allows external hook metadata to be enqueued as trusted system events. Attackers can provide malicious hook names to escalate untrusted input into a higher-trust agent...

ROS-20260417-73-0019

A vulnerability in the Python library for handling PyPDF PDF files involves uncontrolled resource consumption. Exploitation of the vulnerability could allow an attacker acting remotely to affect the availability of protected information...

Dell PowerProtect Data Domain 安全漏洞

Dell PowerProtect Data Domain is a set of hardware devices developed by the American company Dell, used for data protection, backup, storage, and de-duplication. Security vulnerabilities exist in versions 7.7.1.0 to 8.5 of Dell PowerProtect Data Domain BoostFS, as well as in versions 8.3.1.0 to...

PT-2026-33429

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain with Data Domain Operating System DD OS versions 7.7.1.0 through 8.5 Dell PowerProtect Data Domain with Data Domain Operating System DD OS versions 8.3.1.0 through 8.3.1.20 Dell PowerProtect Data Domain with Data...

ROS-20260417-73-0029

Vulnerability in python-authlib related to information disclosure through inconsistency. Exploitation of the vulnerability may allow an attacker acting remotely to gain unauthorized access to protected information...

pac4j 安全漏洞

pac4j is a simple yet powerful Java security engine developed by pac4j OpenSource. It is used to authenticate users, retrieve their configuration files, and manage authorization, thereby protecting web applications and web services. There were security vulnerabilities in versions of pac4j before...

PT-2026-33452

Name of the Vulnerable Software and Affected Versions pac4j versions prior to 4.5.10 pac4j versions prior to 5.7.10 pac4j versions prior to 6.4.1 Description LDAP Injection is possible in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search...

ROS-20260417-73-0013

A vulnerability in the commonprefix function of the pip module of the Python programming language is related to an incorrect directory path name restriction. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to add and modify arbitrary files...

GHSA-48M6-CH88-55MJ Flowise: Improper Mass Assignment in Account Registration Enables Unauthorized Organization Association

Summary An improper mass assignment JSON injection vulnerability in the account registration endpoint of Flowise Cloud allows unauthenticated attackers to inject server-managed fields and nested objects during account creation. This enables client-controlled manipulation of ownership metadata,...

EUVD-2023-24764

Insufficient checks of the RMP on host buffer access in IOMMU may allow an attacker with privileges and a compromised hypervisor to trigger an out of bounds condition without RMP checks, resulting in a potential loss of confidential guest integrity...

EUVD-2026-23231

An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a crafted link placed in a valid e-mail message...

dotnet: .NET: Security Bypass and Denial of Service Vulnerability

A flaw was found in .NET. A remote attacker could exploit a vulnerability related to unsafe transforms in EncryptedXml. This could lead to a Denial of Service DoS, making the service unavailable, and a bypass of security features...

CVE-2026-2840

The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eebmailto' shortcode in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-3369

The CVE-2026-3369 entry describes a Stored XSS in the WordPress plugin Better Find and Replace – AI-Powered Suggestions up to version 1.7.9 due to insufficient input sanitization and output escaping. The vulnerability can be exploited by authenticated attackers with author-level access+ , who can...

EUVD-2026-23209

The BetterDocs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'betterdocsfeedbackform' shortcode in all versions up to, and including, 4.3.8. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes. This makes it possible...