CVE-2026-82607 Cozmoslabs Profile Builder Plugin Avatar Simple Upload AJAX admin-ajax.php wppb_ajax_simple_avatar unrestricted upload

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...

EUVD-2026-68329

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppbajaxsimpleavatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload. Th...

EUVD-2026-68291

A vulnerability was identified in Open5GS up to 2.7.7. This issue affects some unknown processing of the file src/amf/namf-handler.c of the component Transfer Endpoint. Such manipulation leads to null pointer dereference. The attack can be launched remotely. Upgrading to version 2.8.0 is capable ...

EUVD-2026-68292

A security flaw has been discovered in Open5GS up to 2.7.7. Impacted is the function amfnamfcommhandlen1n2messagetransfer of the file src/amf/namf-handler.c of the component N1-N2 Message Handler. Performing a manipulation of the argument...

EUVD-2026-68295

A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler Endpoint. The manipulation of the argument partition results in stack-based buffer overflow. The attack can be executed remotely...

EUVD-2026-68293

A weakness has been identified in Open5GS up to 2.7.7. The affected element is the function smfnudmsdmhandleget of the file src/smf/nudm-handler.c of the component SMF. Executing a manipulation of the argument preemptCap can lead to reachable assertion. The attack may be launched remotely...

CVE-2026-82608

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get4bytes of the file src/modules/imsregistrarscscf/cxdxavp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has bee...

PT-2026-83935

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82699: Cleartext Storage of Sensitive Information

A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive...

CVE-2026-82695: Missing Authentication for Critical Function

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may b...

PT-2026-83682

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get 4bytes of the file src/modules/ims registrar scscf/cxdx avp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has...

PT-2026-83681

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the function wppb ajax simple avatar of the file /wp-admin/admin-ajax.php of the component Avatar Simple Upload AJAX Handler. Performing a manipulation results in unrestricted upload...

PT-2026-83901

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is...

CVE-2026-82624: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

Debian dla-4765 : expat - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4765 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4765-1 [email protected]...

SeaweedFS TUS Bypass Write Delete

The vulnerability of the TUS distributed file system SeaweedFS relates to the bypassing of authentication using a user-controlled key. Exploiting this vulnerability allows an attacker, operating remotely, to circumvent existing security mechanisms and gain access to write and delete arbitrary fil...

PT-2026-83820

A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive...

CVE-2026-82670: Improper Privilege Management

A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRPMJDEVICECONTROL in the library IUForceDelete.sys of the component IOCTL Handler. Executing a manipulation can lead to improper privilege management. The attack requires local access. The vendor was contacted early...

PT-2026-83955

A vulnerability was determined in dibo-software diboot 3.8.0. This affects an unknown part of the file /api/iam/tenant/resource of the component Tenant Resource Assignment Handler. Executing a manipulation of the argument tenantId can lead to improper access controls. The attack may be launched...

CubeCart 6.7.4 - Stored XSS

Exploit Title: CubeCart 6.7.4 - Stored Cross-Site Scripting Date: 2026-06-08 Exploit Author: Mikail Kocadağ MKLKCDG Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE: CVE-2026-54645 Advisory / References:...