6355 matches found
CVE-2026-63550 MZ Automation libiec61850 Out-of-bounds Read
The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session TCP port 102, the decoder may advance its internal read position incorrectly, leading to a he...
CVE-2026-63550
The CVE-2026-63550 issue affects the MMS BER decoder, where a boundary-handling flaw in processing certain fields of confirmed-request messages can cause the decoder to advance its read position incorrectly on receiving a BER-encoded element over an established MMS session (TCP port 102). This ma...
PT-2026-66632
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The MMS BER decoder has a boundary-handling flaw when processing specific fields in confirmed-request messages. If a crafted BER-encoded element is sent over an...
SUSE CVE-2026-63905
In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudcremove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudcremove. The original thread stalled on Shuah Khan's request for runtime testing of...
EUVD-2026-41492
The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including, 2.4.4. This is due to the POST /motopress/appointment/v1/bookings REST endpoint being registered with 'permissioncallback' = 'returntrue',...
CVE-2026-9180
MotoPress Appointment Booking for WordPress (versions up to 2.4.4) is vulnerable to an Authorization Bypass via a user-controlled booking_id. The REST endpoint POST /motopress/appointment/v1/bookings is registered with a permissive permission_callback (return_true ), and createBooking() loads the...
PT-2026-55499
Name of the Vulnerable Software and Affected Versions MotoPress Appointment Booking versions prior to 2.4.5 Description The plugin contains an authorization bypass issue allowing unauthenticated users to modify booking details. The POST /motopress/appointment/v1/bookings endpoint is accessible to...
CVE-2026-53907 Stored Cross‑Site Scripting in MCO
MCO is vulnerable to Stored Cross‑Site Scripting XSS via the application logo upload functionality. An attacker with the ability to change the application logo can upload a crafted SVG file containing malicious JavaScript code that is executed when the logo is rendered or opened. Because vendor...
CVE-2026-10823
creationtimestamp| type| source ---|---|--- 2026-06-29 12:00:04+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-10823.yaml 2026-06-30 00:00:03+00:00| confirmed|...
CVE-2026-55592
creationtimestamp| type| source ---|---|--- 2026-06-22 02:53:55+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-55592.yaml 2026-06-24 15:00:04+00:00| confirmed|...
CVE-2026-54066
creationtimestamp| type| source ---|---|--- 2026-06-19 07:23:13+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-54066.yaml 2026-07-10 20:35:23+00:00| published-proof-of-concept|...
CVE-2026-54069
creationtimestamp| type| source ---|---|--- 2026-06-17 04:18:47+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-54069.yaml 2026-07-10 19:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqcwdmy6ok2t 2026-07-10...
CVE-2025-61224
creationtimestamp| type| source ---|---|--- 2026-06-16 04:05:56+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-61224.yaml...
CVE-2026-50230
creationtimestamp| type| source ---|---|--- 2026-06-12 02:49:16+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-50230.yaml...
CVE-2026-2652
creationtimestamp| type| source ---|---|--- 2026-06-04 09:46:33+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-2652.yaml 2026-08-08 10:06:36+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2026-08-07 2026-08-08...
EUVD-2026-34094
ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth e.g., 12072000 for 12 July 2000. The application does not require or prompt users to change the password upon first login. This behavior...
CVE-2026-39352
creationtimestamp| type| source ---|---|--- 2026-05-25 09:50:58+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-39352.yaml...
CVE-2024-9362
creationtimestamp| type| source ---|---|--- 2026-05-23 14:18:54+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-9362.yaml...
CVE-2026-43913
A flaw was found in Vaultwarden, a Bitwarden-compatible server. An authenticated user, who has been invited as an organization owner and accepted the invitation but has not yet been confirmed by an existing owner, can exploit this vulnerability. By calling a specific API endpoint, this user can...