EUVD-2026-87833

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the...

CVE-2026-100745 Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the...

CVE-2026-100745 Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the...

PT-2026-99502

Name of the Vulnerable Software and Affected Versions Verge3D Publishing and E-Commerce WordPress plugin versions prior to 4.13.1 Description The plugin fails to restrict access to a file-download handler. This allows unauthenticated users to download digital-goods files attached to any order...

PT-2026-99489

Name of the Vulnerable Software and Affected Versions coollabsio Coolify versions prior to 4.1.1 Description A remote issue exists in the GitHub App Setup Handler component within the Github::redirect function of the /webhooks/source/github/redirect file. Manipulation of the state argument allows...

PT-2026-99546

Name of the Vulnerable Software and Affected Versions Netcore NBR100V2 version 1.3.240614.030928 Description An authorization bypass exists in the ACL Handler component within the file /usr/share/rpcd/acl.d/unauthenticated.json. A remote attacker can manipulate the section argument of the uci.app...

PT-2026-99548

Name of the Vulnerable Software and Affected Versions Netcore NBR200V2 version 1.3.241127.071246.071246 Description An OS command injection flaw exists in the Tools Ping Handler component. A remote attacker can trigger this issue by manipulating the url argument passed to the system function with...

CVE-2026-92995: Exposure of Sensitive Information to an Unauthorized Actor

The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization...

CVE-2026-100746: Missing Authentication for Critical Function

A vulnerability was found in coollabsio Coolify up to 4.1.0. This affects the function Github::redirect of the file /webhooks/source/github/redirect of the component GitHub App Setup Handler. The manipulation of the argument state results in missing authentication. The attack can be executed...

CVE-2026-100745: Stack-based Buffer Overflow

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the...

PT-2026-99488

Name of the Vulnerable Software and Affected Versions Edimax BR-6428nC version 1.16 Description A stack-based buffer overflow exists in the Wireless Wizard Handler component within the /goform/formWizSurvey endpoint. This issue occurs when the interface1 or interface2 arguments are manipulated,...

CVE-2026-100672

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100640

SiYuan before v3.8.4 contains an authorization omission in the siyuan-get IPC handler that allows remote-kernel renderers to access native clipboard formats by invoking clipboardReadMathML, clipboardReadOffice, and clipboardReadWPS commands with matching plaintext. Attackers controlling remote...

CVE-2026-100634

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...

rainbet-casino-exploit

CVE-2026-31337 — Seed Rotation TOCTOU Race Condition PoC !...

CVE-2026-100672

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

EUVD-2026-87766

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100672

The Comments plugin (getgrav/grav-plugin-comments ) for Grav CMS through version 1.2.10 contains an authentication bypass that allows for unauthenticated information disclosure . The root cause is an admin handler that incorrectly uses the isAdmin() function, which only verifies if the admin serv...

CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...

CVE-2026-100634 SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows

SiYuan before v3.8.4 does not validate the sender or restrict recipients in the 'siyuan-send-windows' IPC handler of the Electron main process app/electron/main.js. The handler ignores event.sender and forwards any received payload to every BrowserWindow returned by BrowserWindow.getAllWindows,...