CVE-2026-104620

A path traversal attack exists in the simulation of actions within the Zypp backend of PackageKit versions prior to 1.4.1 . This vulnerability could allow local attackers to escalate privileges to root . No specific exploit details or remediation steps are provided in the documents.

CVE-2026-104620

A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges...

SIMATIC RTLS Locating Manager Code Execution

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager is related to deficiencies in the mechanism for verifying input data during backup scenario execution. Exploiting this vulnerability could allow an attacker, operating...

EUVD-2026-120069

A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges...

dnsmasq: DHCPv6 CLID buffer overflow in helper process

A heap buffer overflow was discovered in dnsmasq's DHCP script helper process. When processing DHCPv6 client identifiers CLIDs, the helper hex-encodes the raw CLID bytes into a fixed-size buffer without length validation. Since DHCPv6 CLIDs can be up to 65,535 bytes, a crafted DHCPv6 packet can...

CVE-2026-113362

Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier excluding Ver 7.3.3, Ver 7.6.0 and Ver 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges via a...

CVE-2026-113364

A Heap-based Buffer Overflow exists in the data receiving process of NEC Corporation WebSAM WinShare on Windows, affecting versions 7.5.0 and earlier , 7.6.0 , and 7.7.0 through 7.7.2 . A remote unauthenticated attacker can exploit this by sending a crafted packet containing a malformed data size...

EUVD-2026-119798

Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privileges via a crafted packet with a malformed data size value ...

CVE-2026-113363

NEC Corporation WebSAM WinShare on Windows is vulnerable to an Improper Input Validation flaw in network communication processing. This issue affects versions 7.2.0 through 7.5.0 , 7.6.0 , and 7.7.0 through 7.7.2 . A remote unauthenticated attacker can exploit this by sending a crafted network pa...

EUVD-2026-119797

Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet...

CVE-2026-113362

NEC Corporation WebSAM Winshare (Windows) versions 7.5.0 and earlier (excluding 7.3.3), 7.6.0, and 7.7.0 through 7.7.1 are vulnerable to an Improper Access Control flaw in the program installation folder. This vulnerability allows a locally authenticated low-privileged attacker to execute arbitra...

EUVD-2026-119796

Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier excluding Ver 7.3.3, Ver 7.6.0 and Ver 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attacker to execute arbitrary code with SYSTEM privileges via a...

System Dashboard < 2.8.15 - Admin+ Path Traversal

The System Dashboard WordPress plugin before 2.8.15 does not validate user input used in a path, which could allow high privilege users such as admin to perform path traversal attacks an read arbitrary files on the server id: CVE-2024-10708 info: name: System Dashboard 2.8.15 - Admin+ Path...

WordPress WPLP Cookie Consent < 4.4.2 - SQL Injection

The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to execute arbitrary SQL commands. id: CVE-2026-82186 info: name: WordPress WPLP Cookie Consent 4.4.2 - SQL Injectio...

Coda v.2024Q1 - Cross-Site Scripting

Cross Site Scripting vulnerability in Unit4 Financials by Coda v.2024Q1 allows a remote attacker to escalate privileges via a crafted script to the cols parameter. id: CVE-2024-28734 info: name: Coda v.2024Q1 - Cross-Site Scripting author: s4e-io severity: medium description: | Cross Site Scripti...

KevinLAB BEMS (Building Energy Management System) - Backdoor Account

KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highes...

Pheditor 2.0.1-2.0.3 - OS Command Injection

Pheditor 2.0.1 to - 2.0.4 contains an OS command injection caused by improper sanitization of the 'dir' POST parameter in the terminal action handler, letting authenticated users execute arbitrary OS commands with web server privileges. id: CVE-2026-48030 info: name: Pheditor 2.0.1-2.0.3 - OS...

Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

WordPress Check & Log Email < 2.0.15 - SQL Injection

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks. id: CVE-2026-14554 info: name: WordPress Check & Log Email 2.0.15 - SQL Injection...

CVE-2026-113363: NEC Corporation WebSAM WinShare: Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through…

Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary commands with SYSTEM privileges via a crafted network packet...