CVE-2026-66047 ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...

github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass...

CVE-2026-82699

A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive...

CVE-2026-82699 sambitraj Student Management System Password aca.sql cleartext storage

A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive...

EUVD-2026-68520

A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive...

CVE-2026-82699 sambitraj Student Management System Password aca.sql cleartext storage

A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive...

CVE-2026-82699

A cleartext storage vulnerability exists in the Password Handler component of sambitraj Student Management System (rolling release, up to commit 56ba287f). The flaw resides in the file aca.sql , where manipulation of the Password argument can result in sensitive information being stored in plaint...

CVE-2026-82699 sambitraj Student Management System Password aca.sql cleartext storage

A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive...

SUSE CVE-2026-72133

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: Fix completion initialization order before devmrequestirq The driver calls devmrequestirq before initializing the completion used by the interrupt handler. Because the interrupt may occur immediately after...

SUSE CVE-2026-72146

In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: Move interrupt request after everything is set up Once the interrupt is requested, the interrupt handler may run immediately. Since the IRQ handler can access channel-chbase, which is initialized only afte...

CVE-2026-82695

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may b...

FreeRDP: FreeRDP: Denial of Service due to RDPEI message processing

A flaw was found in FreeRDP. A remote attacker can exploit a vulnerability in the Remote Desktop Protocol RDP Enhanced Input RDPEI server channel handler. By sending a malicious RDPEI message with an oversized declared body length, the attacker can force the server to allocate excessive memory,...

EUVD-2026-68509

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may b...

CVE-2026-82695 Tenda AC18 Telnet telnet missing authentication

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may b...

CVE-2026-82695

A missing authentication flaw affects the Telnet Handler component (file /goform/telnet) in Tenda AC18 firmware version 15.03.05.19 , allowing a remote attacker to access the device without credentials. The flaw is rated CVSS 4.0 base score 10.0 (CRITICAL) with low attack complexity, no privilege...

CVE-2026-82695 Tenda AC18 Telnet telnet missing authentication

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may b...

CVE-2026-82691

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usbdevice.cgi of the component CGI Handler. Such manipulation of the argument fupsip leads to os command injection. The attac...

CVE-2026-82689

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomountmgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can b...

CVE-2026-82691 D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usbdevice.cgi of the component CGI Handler. Such manipulation of the argument fupsip leads to os command injection. The attac...

CVE-2026-82691

A remote OS command injection vulnerability affects D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 through firmware version 20260717 . The flaw resides in the CGI Handler file /cgi-bin/usb_device.cgi, where unsanitized input to the f_ups_ip argument allows an attacker to inject arbitrary OS com...