CVE-2026-16296

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

CVE-2026-18723

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The...

EUVD-2026-52572

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The...

CVE-2026-18723 diaowen DWSurvey Survey Status up-survey-status.do improper authorization

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The...

CVE-2026-18723

CVE-2026-18723 affects diaowen DWSurvey up to version 6.14.0. The vulnerability lies in an unknown function within /api/dwsurvey/app/survey/up-survey-status.do of the Survey Status Handler, leading to improper authorization. Exploitation could be remote (network vector) with low privileges requir...

CVE-2026-18723 diaowen DWSurvey Survey Status up-survey-status.do improper authorization

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The...

CVE-2026-18722

A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched...

CVE-2026-18722

Technical details (affected product, vulnerable component, root cause, impact, fixes) are not publicly available in the provided documents; monitor for updates.

PT-2026-67731

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent versions prior to 2026.6.6 Description An issue in the Quick Command Handler component allows for incorrect authorization. The flaw exists within the check slash access function located in the gateway/run.py file and...

PT-2026-67888

Name of the Vulnerable Software and Affected Versions Ehco1996 django-sspanel versions prior to 2023.12.26 Description A weakness in the Support Ticket Handler component allows for a remote authorization bypass. This issue occurs within the TicketDetailView function located in the...

PT-2026-67725

Name of the Vulnerable Software and Affected Versions Perspective version 5.0.0 Description An issue exists that allows unauthenticated remote attackers to read arbitrary files from the server filesystem. By including literal ../ segments in HTTP request URL paths, attackers can bypass insufficie...

PT-2026-67638

A vulnerability was determined in diaowen DWSurvey up to 6.14.0. The affected element is an unknown function of the file /api/dwsurvey/app/survey/up-survey-status.do of the component Survey Status Handler. This manipulation causes improper authorization. The attack may be initiated remotely. The...

PT-2026-67718

Name of the Vulnerable Software and Affected Versions vibesurf-ai VibeSurf versions up to cd6e519d507cdd4d63061300bf60fb176e1f57e0 Description A code injection flaw exists within the Python Validation Handler component, specifically affecting an unknown function in the /code file. This issue allo...

CVE-2026-18818: Authorization Bypass Through User-Controlled Key

A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The...

CVE-2026-18790: Out-of-bounds Read

A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMacProcessMsgDeleteMonitoredItemsResponse of the file src/ClientServer/frontend/clientwrapper/internal/statemachine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes...

CVE-2026-18773: Incorrect Authorization

A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function checkslashaccess of the file gateway/run.py of the component Quick Command Handler. The manipulation results in incorrect authorization. The attack can be launched remotely. The exploi...

CVE-2026-18770: Improper Control of Generation of Code

A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This produc...

CVE-2026-16296: URL Redirection to Untrusted Site

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-defaul...

CVE-2025-29296

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The...

CVE-2026-48154: Concurrent Execution using Shared Resource with Improper Synchronization

GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and...