EUVD-2026-58769

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal...

CVE-2026-18178 IBM Db2 Mirror for i is affected by multiple vulnerabilities

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal...

CVE-2026-18178

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to delete arbitrary files due to path traversal...

CVE-2026-57472

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...

CVE-2026-19835

A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available an...

CVE-2026-73621

A flaw was found in GitPython. An argument injection vulnerability in the Commit.count method allows an attacker to control options passed to the method. By supplying a crafted output option, an attacker can cause the git rev-list command to truncate an arbitrary file to zero bytes. This enables...

CVE-2026-19835 Webkul Bagisto Customer Item Deletion Endpoint access control

A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available an...

CVE-2026-57472

CVE-2026-57472 affects the KUNBUS RevPiPyLoad 0.11.0 XML-RPC management interface. A CWE-22 path traversal in the file management functionality enables a local unauthenticated attacker to delete arbitrary files with the RevPiPyLoad daemon privileges, leading to loss of configuration integrity and...

EUVD-2026-58678

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...

CVE-2026-57472 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to...

CVE-2026-57469

Nozomi Networks Labs identifies a CSRF vulnerability (CWE-352) in the web-based configuration backend of KUNBUS PiCtory v2.16.0. The issue allows a remote unauthenticated attacker to perform state-changing actions within an authenticated operator session by tricking a victim into submitting craft...

EUVD-2026-58676

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-19823

A security flaw has been discovered in Tenda W20E 15.11.0.610681546841CNTDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the...

CVE-2026-19823 Tenda W20E QoS Rule Deletion delQos formQOSRuleDel stack-based overflow

A security flaw has been discovered in Tenda W20E 15.11.0.610681546841CNTDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the...

CVE-2026-19823

The CVE-2026-19823 entry concerns Tenda W20E firmware version 15.11.0.6(1068_1546_841)_CN_TDC. The affected component is the QoS Rule Deletion functionality, specifically the formQOSRuleDel function in /goform/delQos. The root cause is a stack-based buffer overflow triggered by manipulating the q...

CVE-2026-19823

A security flaw has been discovered in Tenda W20E 15.11.0.610681546841CNTDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the...

EUVD-2026-58622

A security flaw has been discovered in Tenda W20E 15.11.0.610681546841CNTDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the...

WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by Asim Alshaya in WordPress Plugin Breeze versions = 2.5.12...

CVE-2025-10308

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

CVE-2025-10308

The Astro Booking Engine WordPress plugin is affected by a CSRF (Cross-Site Request Forgery) vulnerability in all versions up to 1.4.0, caused by missing nonce validation on the options deletion function. This allows unauthenticated attackers to delete all plugin settings by tricking a site admin...