CVE-2026-3617

The Paypal Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'amount' and 'name' shortcode attributes in all versions up to, and including, 0.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The...

CVE-2026-3460 REST API TO MiniProgram <= 5.1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'userid' REST API Parameter

The REST API TO MiniProgram plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2. This is due to the permission callback updateuserwechatshopinfopermissionscheck only validating that the supplied 'openid' parameter corresponds to an...

EUVD-2026-13976

OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind metadata and permissive name heuristics. Attackers can bypass interactive approval prompts for read-class operations by spoofing tool...

CVE-2019-25546: Out-of-bounds Write

NetAware 1.20 contains a buffer overflow vulnerability in the Share Name field that allows local attackers to crash the application by supplying an excessively long string. Attackers can trigger a denial of service by pasting a 1000-byte buffer into the Share Name parameter when adding a new shar...

PT-2026-26911

TransMac 12.3 contains a buffer overflow vulnerability in the volume name field that allows local attackers to crash the application by supplying an excessively long string. Attackers can create a malicious file with 1000 repeated characters, paste the content into the volume name field during di...

Tomabo MP4 Converter 缓冲区错误漏洞

Tomabo MP4 Converter is a video format conversion tool developed by Tomabo Corporation. Version 3.25.22 of Tomabo MP4 Converter has a buffer overflow vulnerability. This vulnerability stems from the input of excessively long strings in the name field. It could allow local attackers to inject...

PT-2026-26904

SpotPaltalk 1.1.5 contains a denial of service vulnerability in the registration code input field that allows local attackers to crash the application by submitting an excessively long string. Attackers can paste a buffer of 1000 characters into the Name/Key field during registration to trigger a...

CVE-2019-25566: Out-of-bounds Write

TransMac 12.3 contains a buffer overflow vulnerability in the volume name field that allows local attackers to crash the application by supplying an excessively long string. Attackers can create a malicious file with 1000 repeated characters, paste the content into the volume name field during di...

CVE-2019-25559: Improper Handling of Overlap Between Protected Memory Ranges

SpotPaltalk 1.1.5 contains a denial of service vulnerability in the registration code input field that allows local attackers to crash the application by submitting an excessively long string. Attackers can paste a buffer of 1000 characters into the Name/Key field during registration to trigger a...

PT-2026-26890

Terminal Services Manager 3.2.1 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying an excessively long string in the computer name field. Attackers can input a 5000-byte buffer of data into the 'Computer name or IP address' field during...

CVE-2019-25554: Out-of-bounds Write

Tomabo MP4 Converter 3.25.22 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can trigger a buffer overflow by pasting a large payload into the Name parameter when adding a preset i...

CVE-2019-25545: Out-of-bounds Write

Terminal Services Manager 3.2.1 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying an excessively long string in the computer name field. Attackers can input a 5000-byte buffer of data into the 'Computer name or IP address' field during...

jetAudio 缓冲区错误漏洞

JetAudio is a multimedia player software developed by the JetAudio company. Version 8.1.7 of JetAudio contains a buffer overflow vulnerability. This vulnerability stems from a buffer overflow in the file name field of the video conversion component. It could allow local attackers to trigger the...

PT-2026-26891

NetAware 1.20 contains a buffer overflow vulnerability in the Share Name field that allows local attackers to crash the application by supplying an excessively long string. Attackers can trigger a denial of service by pasting a 1000-byte buffer into the Share Name parameter when adding a new shar...

PT-2026-26899

Tomabo MP4 Converter 3.25.22 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string in the Name field. Attackers can trigger a buffer overflow by pasting a large payload into the Name parameter when adding a preset i...

LizardSystems Terminal Services Manager 缓冲区错误漏洞

LizardSystems Terminal Services Manager is a terminal service management software developed by LizardSystems Corporation. Version 3.2.1 of LizardSystems Terminal Services Manager contains a buffer error vulnerability. This vulnerability stems from a local buffer overflow in the computer name fiel...

Acute Systems TransMac 缓冲区错误漏洞

Acute Systems TransMac is a tool software developed by Acute Systems that allows access and management of Mac disks and file systems on Windows systems. Version 12.3 of Acute Systems TransMac contains a buffer error vulnerability. This vulnerability stems from a buffer overflow in the volume name...

EUVD-2026-13796

Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the...

EUVD-2026-13798

Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification...

Use of Incorrectly-Resolved Name or Reference

Overview h3 is a Minimal HTTP framework built for high performance and portability. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the mount method. An attacker can manipulate request context and set unintended privilege flags by crafting...