CVE-2018-25159 Epross AVCON6 OGNL Remote Code Execution via login.action

Epross AVCON6 systems management platform contains an object-graph navigation language OGNL injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OG...

CVE-2018-25159

Epross AVCON6 systems management platform contains an object-graph navigation language OGNL injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OG...

CVE-2026-28803

Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned...

CVE-2026-28803 Open Forms possible to view submission details of other people than intended

Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned...

CVE-2026-28803

CVE-2026-28803 affects Open Forms with cosign flow prior to versions 3.3.13 and 3.4.5. The vulnerability allows a logged-in user to implicitly retrieve arbitrary submissions by guessing/modifying the cosign code received by email, enabling access to submission references during cosign flow. The i...

CVE-2026-28803 Open Forms possible to view submission details of other people than intended

Open Forms allows users create and publish smart forms. Prior to 3.3.13 and 3.4.5, to be able to cosign, the cosigner receives an e-mail with instructions or a deep-link to start the cosign flow. The submission reference is communicated so that the user can retrieve the submission to be cosigned...

EUVD-2026-11123

The Modular DS: Monitor, update, and backup multiple websites plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.1. This is due to missing nonce validation on the postConfirmOauth function. This makes it possible for unauthenticated attacker...

CVE-2025-70802

Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etcro/shadow, which allows attackers to log in as root...

CVE-2025-70798

Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etcro/shadow, which allows attackers to log in as root...

CVE-2026-0953

The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token...

WordPress Tutor LMS Pro plugin <= 3.9.5 - Authentication Bypass via Social Login vulnerability

Authentication Bypass via Social Login vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Tutor LMS Pro versions = 3.9.5...

org.keycloak:keycloak-account-freemarker (1.0-alpha-3), org.keycloak:keycloak-login-freemarker (1.0-alpha-3) +1 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (1.0-alpha-3)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-3 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.0-alpha-2), org.keycloak:keycloak-login-freemarker (1.0-alpha-2) +1 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (1.0-alpha-2)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-2 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.0-alpha-4), org.keycloak:keycloak-login-freemarker (1.0-alpha-4) +1 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (1.0-alpha-4)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-4 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.1.0.beta2), org.keycloak:keycloak-dependencies-server-min (1.1.0.beta2) +1 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (1.1.0.beta2)

org.keycloak:keycloak-services MAVEN version 1.1.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.0.beta2 -...

com.charlyghislain.keycloak:keycloak-importexport (23.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.13) +26 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (23.0.3)

org.keycloak:keycloak-services MAVEN version 23.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport 23.0.1 -...

org.keycloak:keycloak-account-freemarker (1.0-rc-2), org.keycloak:keycloak-dependencies-server-all (1.0-rc-2) +3 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (1.0-rc-2)

org.keycloak:keycloak-services MAVEN version 1.0-rc-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-rc-2 - org.keycloak:keycloak-dependencies-server-al...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.final), org.keycloak:keycloak-account-freemarker (1.0-rc-1) +4 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (1.0-rc-1)

org.keycloak:keycloak-services MAVEN version 1.0-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.final -...

com.charlyghislain.keycloak:keycloak-importexport (>=11.0.1, <=11.0.2), fr.cnieg.keycloak:attribute-login-provider (>=1.1.0, <=1.2.4) +9 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (11.0.2)

org.keycloak:keycloak-services MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport =11.0.1, =1.1.0, =1.2.4 -...

org.keycloak:keycloak-account-freemarker (1.0.1.final), org.keycloak:keycloak-dependencies-server-all (1.0.1.final) +3 more potentially affected by CVE-2026-3911 via org.keycloak:keycloak-services (1.0.1.final)

org.keycloak:keycloak-services MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0.1.final -...