PT-2026-65421

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

PT-2026-65417

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability...

PT-2026-65515

Pterodactyl is a free, open-source game server management panel. From 1.7.0 until 1.13.0, the authentication rate limiter defined in RouteServiceProvider::configureRateLimiting applied a single global bucket to the login and two-factor checkpoint endpoints instead of keying by IP or account: the...

PT-2026-65431

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wp ajax pos get option AJAX handler, which verifies only a nonce tha...

PT-2026-65422

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

CVE-2026-65561

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

Hackers Compromise Hotel Wi-Fi Gateways to Hijack Microsoft 365 Accounts

Compromised hotel Wi-Fi gateways redirect business travelers to fake Microsoft 365 login pages allowing attackers to steal credentials and authorization tokens...

EUVD-2026-49234

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

CVE-2026-65561

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

CVE-2026-65561

CVE-2026-65561 concerns the WordPress WordPress Social Login and Register plugin (versions

CVE-2026-65561 WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

CVE-2026-65561 WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

CVE-2026-12495

Denial-of-service DoS vulnerability due to a stack buffer overflow in the httpgdprdecrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory...

CVE-2026-12495 Stack-Based Buffer Overflow in the Mercusys MB115-4G

Denial-of-service DoS vulnerability due to a stack buffer overflow in the httpgdprdecrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory...

CVE-2026-12495 Stack-Based Buffer Overflow in the Mercusys MB115-4G

Denial-of-service DoS vulnerability due to a stack buffer overflow in the httpgdprdecrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory...

CVE-2026-12495

CVE-2026-12495: A stack-based buffer overflow in the Mercusys MB115-4G web interface (http_gdpr_decrypt) can be triggered by a crafted request to /cgi/login, leading to memory corruption and a crash of the httpd process, resulting in DoS of the web administration service. Affected component: Merc...

CVE-2026-12495

Denial-of-service DoS vulnerability due to a stack buffer overflow in the httpgdprdecrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory...

EUVD-2026-49144

Denial-of-service DoS vulnerability due to a stack buffer overflow in the httpgdprdecrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory...

CVE-2026-14820

The Quiz and Survey Master QSM WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid...