EUVD-2026-52326

Improper access control in the IRPMJWRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192, allows a local, unprivileged attacker to achieve local privilege escalation to NT AUTHORITY\SYSTEM, extract credentials from PPL-protected lsass.exe, and terminate PPL-protected...

EUVD-2026-52292

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in setenv.php where the redirectToLoginAdminIRequestHaveAccessToken function derives the current page name from PHPSELF and skips authentication when the value...

WordPress Remote API plugin <= 0.2 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by Pedro Pinho in WordPress Plugin Remote API versions = 0.2...

RHSA-2026:49514 Red Hat Security Advisory: perl-DBI security update

Bulletin has no description...

Important: Red Hat Security Advisory: perl-DBI security update

An update for perl-DBI is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

DBI: DBI: Heap overflow when preparsing SQL statements with excessive placeholders

A flaw was found in DBI for Perl. This vulnerability, a heap overflow, occurs when the software attempts to preparse SQL statements containing an extremely large number of placeholders. This could allow a remote attacker to cause a denial of service or potentially execute arbitrary code...

CVE-2026-9593

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disrupti...

CVE-2026-18589

The CVE-2026-18589 entry concerns Wavlink WL-NU516U1 (model 708c073-mt7628). The vulnerability is in nas.cgi, affecting the change_password function where manipulating User1Passwd triggers a stack-based buffer overflow. It is a NETWORK-accessible flaw with LOW attack complexity and NO user intera...

EUVD-2026-52188

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disrupti...

CVE-2026-9593

The CVE-2026-9593 entry describes a vulnerability in the iDTM FDI where an attacker with elevated privileges on the host can enable the debug interface by placing a crafted file in the application directory. This could lead to unauthorized access to connected devices and exposure, modification, o...

CVE-2026-9593

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disrupti...

CVE-2026-9593 iDTM FDI Unauthorized Debug Interface Enablement

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disrupti...

CVE-2026-9593 iDTM FDI Unauthorized Debug Interface Enablement

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disrupti...

CVE-2026-16563 Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...

CVE-2026-16565

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin, in versions before 5.0.9 , is vulnerable to an authorization bypass due to a failure to verify product ownership on its product-attribute REST write endpoints . This flaw allows any user with a Dokan vendor accou...

EUVD-2026-52153

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...

CVE-2026-18584 GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...

DBI: DBI: Arbitrary code execution via caller-influenced Profile attribute

A flaw was found in the DBI component for Perl. This vulnerability allows an attacker to inject and execute arbitrary code by manipulating the Profile attribute of a DBI handle. When a string is assigned to this attribute, the component processes it without proper validation, enabling the executi...

Important: Red Hat Security Advisory: perl-DBI security update

An update for perl-DBI is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

PT-2026-67115

The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...