49680 matches found
CVE-2026-12739: Missing Authorization
The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-85410: Missing Authorization
The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.2. This is due to the plugin not properly verifying that a user is...
PT-2026-95661
Name of the Vulnerable Software and Affected Versions CordysCRM versions 1.7.0 through 1.7.3 Description An authenticated user with MODULE SETTING UPDATE permissions can execute arbitrary database functions via the POST /account-pool/page endpoint. This occurs because the...
PT-2026-95289
Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit versions prior to 9.118.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs vi...
PT-2026-95340
Name of the Vulnerable Software and Affected Versions Popup Maker versions prior to 1.25.0 Description The Popup Maker plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level...
PT-2026-95432
Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description When operating in prefill/decode disaggregation mode with the Mooncake KV transfer backend, the system fails to validate bootstrap room values. This allows for unbounded transfer state allocation...
The vulnerability of the form_fast_setting_wifi_set() function (/goform/fast_setting_wifi_set) in the Tenda A18 router microprogramming software allows a hacker to trigger a service failure.
The vulnerability of the formfastsettingwifiset function /goform/fastsettingwifiset in the Tenda A18 router microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST...
The vulnerability of the fromAddressNat function (/goform/addressNat) in Tenda CX12L Wi-Fi router software allows a intruder to trigger a service failure.
The vulnerability of the fromAddressNat function /goform/addressNat in Tenda CX12L Wi-Fi routers is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST request...
The vulnerability of the fromwebExcptypemanFilter function (/goform/webExcptypemanFilter) in the Tenda CX12L Wi-Fi router software allows a intruder to trigger a service failure.
The vulnerability of the fromwebExcptypemanFilter function /goform/webExcptypemanFilter in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST reque...
The vulnerability of the fromwebExcptypemanFilter() function (/goform/webExcptypemanFilter) in the httpd component of the Tenda F451 router microprogramming system, which allows a hacker to cause a service failure.
The vulnerability of the fromwebExcptypemanFilter function /goform/webExcptypemanFilter in the httpd component of the Tenda F451 router microprogramming system is related to the issue of the operation going beyond the buffer in memory when processing the page parameter. Exploiting this...
The vulnerability of the fromRouteStatic function (/goform/RouteStatic) in the Tenda CX12L Wi-Fi router software allows a hacker to trigger a service failure.
The vulnerability of the fromRouteStatic function /goform/RouteStatic in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending a specially crafted POST request...
The vulnerability of the fromNatStaticSetting function (/goform/NatStaticSetting) in the Tenda CX12L Wi-Fi router software allows a intruder to trigger a service failure.
The vulnerability of the fromNatStaticSetting function /goform/NatStaticSetting in the Tenda CX12L Wi-Fi router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST request...
PT-2026-95662
Name of the Vulnerable Software and Affected Versions CordysCRM versions prior to 1.7.4 Description An issue exists where the sendWebHook function in ApprovalResourceService reads the webHookUrl variable from the WebHookConfig and passes it to HttpClientUtils via...
PT-2026-95266
Name of the Vulnerable Software and Affected Versions Auto Upload Images versions prior to 3.3.3 Description This issue is a Limited Server-Side Request Forgery SSRF, a flaw that allows a server to be coerced into making requests to an unintended location. Authenticated attackers with...
PT-2026-95281
Name of the Vulnerable Software and Affected Versions WP Easy Pay – Payment and Donation form Builder for Square versions prior to 4.5.1 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated...
PT-2026-95388
Name of the Vulnerable Software and Affected Versions NUUO Network Video Recorder version 2.0.0 Description An arbitrary file read issue exists in the 'up.php' endpoint. The application receives the url parameter via a POST request and uses the fopen function to open the specified URL in binary...
PT-2026-95544
Name of the Vulnerable Software and Affected Versions LMDeploy versions 0.9.2 through 0.15.9 Description LMDeploy's PyTorch DistServe/PD-disaggregation control plane uses the recv pyobj function to deserialize messages received through a ZeroMQ PULL socket. This function relies on Python pickle...
CVE-2026-77164: Server-Side Request Forgery (SSRF)
Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST...
The vulnerability of the set_qosMib_list()/goform/formSetQosBand function in the Tenda A18 router software allows a attacker to trigger a service failure.
The vulnerability of the setqosMiblist /goform/formSetQosBand function in the Tenda A18 router software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to trigger a service failure by sending a specially crafted POST request...
