WordPress plugin Invoct – PDF Invoices & Billing for WooCommerce 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

AMD Graphics Driver 安全漏洞

AMD Graphics Driver is an integrated graphics driver developed by American semiconductor company AMD. There is a security vulnerability in AMD Graphics Driver, which stems from improper logic in the hardware reset flow. This vulnerability could allow privileged attackers to control the reset...

QNAP Systems File Station 路径遍历漏洞

QNAP Systems File Station is an archiving tool under QTS from QNAP Systems. This application allows access to NAS files via a web interface. QNAP Systems File Station 6 has a path traversal vulnerability; this vulnerability stems from path traversal issues, which may allow remote attackers to rea...

CVE-2025-70084

Directory traversal vulnerability in OpenSatKit 2.2.1 allows attackers to gain access to sensitive information or delete arbitrary files via crafted value to the FileUtilGetFileInfo function...

PT-2026-7529

Name of the Vulnerable Software and Affected Versions Media Streaming add-on versions prior to 500.1.1.6 Description An out-of-bounds read issue exists in Media Streaming add-on. An attacker with local network access can exploit this to obtain secret data. Recommendations Update to Media Streamin...

QNAP Systems QuTS hero 安全漏洞

QNAP Systems QuTS hero is an operating system developed by QNAP Systems. Versions prior to h5.3.2.3354 of QNAP Systems QuTS hero contained a security vulnerability caused by a buffer overflow. This vulnerability could allow remote attackers to modify memory or cause processes to crash...

AMD Vivado 安全漏洞

AMD Vivado is a hardware development and integrated design environment provided by the American semiconductor company AMD. AMD Vivado has security vulnerabilities, which stem from DLL hijacking. These vulnerabilities may allow local attackers to gain elevated privileges, enabling them to execute...

PT-2026-7610

GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the event title parameter. Attackers can exploit the CreateEvent.php endpoint by sending crafted POST requests with XSS payloads to execute arbitrary...

WordPress plugin WaMate Confirm – Order Confirmation 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-7496

The MMA Call Tracking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.15. This is due to missing nonce validation when saving plugin configuration on the mma call tracking menu admin page. This makes it possible for unauthenticated...

WordPress plugin WPZOOM Addons for Elementor – Starter Templates & Widgets 信息泄露漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the...

PT-2026-7548

An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: Qsync Central...

QNAP Systems File Station 安全漏洞

QNAP Systems File Station is an archiving tool under the QTS platform developed by QNAP Systems. This application allows access to NAS files via a web interface. Versions of QNAP Systems File Station prior to 5.5.6.5068 had a security vulnerability caused by path traversal, which could allow remo...

CVE-2025-65128

The Shenzhen Zhibotong Electronics ZBT WE2001 (version 23.09.27 ) is vulnerable to a missing authentication mechanism within its web management API components. An unauthenticated attacker on the local network can modify router and network configurations by invoking operations ending with *_nocomm...

CVE-2025-29950

Improper input validation in system management mode SMM could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution...

CVE-2026-21527

User interface ui misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-11004 Reflected XSS vulnerability in Simplicity Device Manager tool

The Simplicity Device Manager Tool has a Reflected XSS Cross-site-scripting vulnerability in several API endpoints. The attacker needs to be on the same network to execute this attack. These APIs can affect confidentiality, integrity, and availability of the system that has Simplicity Device...

CVE-2026-1603

An authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific stored credential data...

CVE-2026-1602

SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database...

CVE-2026-1922

The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ecs-list-events shortcode message attribute in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied...