PT-2026-95629

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An issue exists in the import remotelog config file CLI command where a highly privileged authenticated user can inject shell commands through the filename parameter. This can lead to...

CVE-2026-92554: Improper Neutralization of Input During Web Page Generation

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-90981: Improper Neutralization of Input During Web Page Generation

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-92561: Improper Neutralization of Input During Web Page Generation

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

Tenda CH22 FormWriteFacMac Arbitrary Command Execution

The vulnerability of the FormWriteFacMac function in the /goform/WriteFacMac file of the Tenda CH22 microprogramming system is related to the failure to take measures to neutralize special elements during the processing of the mac parameter. Exploiting this vulnerability can allow an attacker to...

Tenda CH22 Router Code Execution

The vulnerability of the formWrlExtraSet /goform/WrlExtraSet function in the Tenda CH22 router microprogramming system lies in the reading of data outside the buffer in memory during the processing of the GO parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code or...

httpd daemon WrlExtraSet() Code Execution

The vulnerability of the WrlExtraSet function in the httpd daemon of the microprogramming router Tenda FH1202 is related to the execution of an operation outside the buffer in memory when processing the GO parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

FreeBSD LcpDecodeConfig Heap Buffer Overflow DoS

The vulnerability of the LcpDecodeConfig function in the kernel of the FreeBSD operating system is related to improper handling of discrepancies in parameter length. Exploiting this vulnerability can allow a remote attacker to cause service failures or execute arbitrary code...

Tenda F456 Router Code Execution

The vulnerability of the fromaddressNat function /goform/addressNat in the Tenda F456 router’s microprogramming system is related to the copying of buffers without checking the size of the input data when processing the manufacturer parameter. Exploiting this vulnerability allows an attacker to...

Tenda FH451 WrlclientSet Code Execution

The vulnerability of the WrlclientSet function /goform/WrlclientSet of the Tenda FH451 router microprogramming system is related to buffer overflow in the stack when processing the GO parameter. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

Tenda CH22 Parameter Handler Heap Buffer Overflow

The vulnerability of the Parameter Handler component in the fromSetCfm function of the /goform/setcfm microprogramming system Tenda CH22 is related to the occurrence of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

httpd daemon Code Execution

The vulnerability of the fromWrlclientSet function in the httpd daemon’s microprogramming system for Tenda FH1202 is related to the issue where an operation is performed outside the buffer in memory when processing the GO parameter. Exploiting this vulnerability allows a remote attacker to execut...

PT-2026-95245

Name of the Vulnerable Software and Affected Versions Tz Weekly Radio Schedule versions prior to 1.8.2 Description The plugin fails to sanitize and escape the week parameter before incorporating it into a SQL query within an AJAX action. This flaw allows unauthenticated attackers to execute SQL...

PT-2026-95259

Name of the Vulnerable Software and Affected Versions Hide My WP Ghost versions prior to 7.0.11 Description The plugin fails to verify if a request is a genuine WooCommerce request before disabling its firewall, threat-detection, and login/URL-hiding protections. An unauthenticated attacker can...

PT-2026-95300

Name of the Vulnerable Software and Affected Versions ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin versions prior to 3.5.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occur...

PT-2026-95388

Name of the Vulnerable Software and Affected Versions NUUO Network Video Recorder version 2.0.0 Description An arbitrary file read issue exists in the 'up.php' endpoint. The application receives the url parameter via a POST request and uses the fopen function to open the specified URL in binary...

PT-2026-95344

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injectin...

PT-2026-95363

Name of the Vulnerable Software and Affected Versions ABB Freelance Controller DCP versions 2013 through 2019 SP1 ABB Freelance Controller AC700 versions 2013 through 2019 SP1 ABB Freelance Controller AC800 versions 2013 through 2019 SP1 ABB Freelance Controller AC900 versions 2013 through 2019 S...

PT-2026-95274

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...