CVE-2026-15706

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin

On July 24th, 2026, we received a submission for an Unauthenticated Arbitrary File Upload vulnerability in Elementor Pro, a WordPress plugin with an estimated 6,000,000 active installations. This vulnerability makes it possible for unauthenticated attackers to upload arbitrary files, including...

CVE-2026-76634 WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

CVE-2026-76634

WeGIA before 3.9.2 is affected by an Insecure Direct Object Reference (IDOR) vulnerability in the employee profile page (profile_funcionario.php). The root cause is a request extraction function that allows an attacker-supplied id_pessoa parameter to overwrite the session-derived identifier, enab...

CVE-2026-76634 WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

CVE-2026-76634 WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

EUVD-2026-63359

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

CVE-2026-72389

A flaw was found in the Linux kernel's bridge Spanning Tree Protocol STP module. A missing check in the brtopologychangedetection function allows a topology change timer to be armed while a bridge is administratively down. This can be exploited by an attacker to trigger a use-after-free...

EUVD-2026-63349

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-15706

CVE-2026-15706 is a critical authentication bypass in the Management API of Baylan Smart Meter Management Application (BMS) by Baylan Measuring Instruments Industry and Trade Inc. The vulnerability stems from missing authentication for a critical function , allowing unauthenticated network access...

Sql-injection-payloads

SQL Injection Payload List SQL Injection In this...

CVE-2026-76988

A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forwardopen of the file cipconnectionmanager.cc of the component ForwardOpen Handler. Executing a manipulation of the argument productcode can lead to...

CVE-2026-76987

A security flaw has been discovered in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. The impacted element is the function CipAttribute::GetAttrData/CipAttribute::SetAttrData of the file ciptypes.h of the component Generic Attribute Logic. Performing a manipulation results in memory...

CVE-2026-76989

A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enetencap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to out-of-bounds read. The attack can be...

EUVD-2026-63347

A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enetencap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to out-of-bounds read. The attack can be...

CVE-2026-76989 liftoff-sr CIPster TCP Encapsulation Receive Path encap.cc out-of-bounds

A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enetencap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to out-of-bounds read. The attack can be...

CVE-2026-76989

CVE-2026-76989 is an out-of-bounds read in the TCP Encapsulation Receive Path of liftoff-sr CIPster (commit 1802525), located in source/src/enet_encap/encap.cc. The flaw can be triggered remotely without authentication or user interaction, resulting in a low availability impact (no confidentialit...

CVE-2026-76989 liftoff-sr CIPster TCP Encapsulation Receive Path encap.cc out-of-bounds

A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enetencap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to out-of-bounds read. The attack can be...