CVE-2026-92555

Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26...

CVE-2026-107578

Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows,...

EUVD-2026-94868

Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26...

CVE-2026-92555 Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel

Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26...

CVE-2026-92555

The AKINSOFT WOLVOX Control Panel by AKIN Software Computer Import-Export Industry and Trade Co. Ltd. is vulnerable to an insertion of sensitive information into sent data (CWE-201). This flaw allows an attacker to pull data from system resources , potentially including database credentials . The...

CVE-2026-104659

Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding...

CVE-2026-104659 Origin Validation Error in hMailServer

Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding...

CVE-2026-104659

Progressive Robot hMailServer versions 6.0.0 through 6.3.5 are vulnerable to a remote brute-force attack on the administrator password due to missing Host header validation and a lack of throttling on failed sign-ins within the REST API listener. While the listener is off by default and bound to ...

CVE-2026-104659 Origin Validation Error in hMailServer

Missing Host header validation and missing throttling of failed administrator sign-ins in the REST API listener of Progressive Robot hMailServer 6.0.0 through 6.3.5 allow a remote attacker to brute-force the server administrator's password through the administrator's own browser by DNS rebinding...

WordPress Sell Downloads plugin <= 1.2.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by c4st1e in WordPress Plugin Sell Downloads versions = 1.2.3...

TataShops-cyber-check-attacks

TataShops — Application Security & DAST Laboratory TataShop...

CVE-2026-85421

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Baikuya in WordPress Theme Motors versions = 1.4.108...

CVE-2026-105196

The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to read and modify other agents' profile da...

CVE-2026-85421

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

CVE-2026-85421

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

CVE-2026-85421

A critical security vulnerability exists in Brocade ASCG versions prior to 3.5.0 . The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can exploit this flaw to issue control commands, modify syst...

EUVD-2026-94786

A critical security vulnerability has been identified in Brocade ASCG versions before 3.5.0. The HTTPS service fails to properly enforce authentication or access control checks on incoming requests. An unauthenticated attacker with network access can issue control commands, alter cluster states,...

EUVD-2026-94769

The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any order, customer, or transaction on th...

CVE-2026-94584

A race condition and thread-safety vulnerability exists in the web management daemon of Brocade Fabric OS versions before 10.0.1. When handling user authentication requests across a multi-threaded execution pool, this race condition causes PAM modules to process stale or incorrect client IP...