25718 matches found
PT-2026-6089
Name of the Vulnerable Software and Affected Versions Samsung Settings versions prior to SMR Feb-2026 Release 1 Description A flaw exists in privilege management within Samsung Settings. This allows local attackers to execute arbitrary actions with elevated privileges. Recommendations Update...
PT-2026-5881
Name of the Vulnerable Software and Affected Versions Docker Desktop for Windows affected versions not specified Description Docker Desktop for Windows has permission assignment issues in the installer’s handling of the C:ProgramDataDockerDesktop directory. The installer does not properly verify...
WordPress plugin Magic Import Document Extractor 信息泄露漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
SAMSUNG Mobile devices 安全漏洞
Samsung Mobile devices are a series of mobile devices produced by South Korea’s Samsung Corporation, including smartphones and tablets. Versions of Samsung Mobile Devices prior to SMR Feb-2026 Release 1 contained security vulnerabilities. These vulnerabilities stemmed from improper permission...
Linux kernel 安全漏洞
The Linux kernel is the kernel used by the Linux operating system developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from a lack of connector type settings. This vulnerability may cause the panel to fail and trigger warnings...
Microhard IPn4G Cellular Gateways Cross-Site Request Forgery (CVE-2018-25149)
Microhard Systems IPn4G 1.1.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to change admin passwords, add new users, and modify system settings by tricking authenticated...
CVE-2026-1632
MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication, which could allow an unauthenticated attacker to modify configuration settings, acquire device data or remotely reset the device...
CVE-2026-1633 Synectix LAN 232 TRIO Missing Authentication for Critical Function
The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, allowing unauthenticated users to modify critical device settings or factory reset the device...
CVE-2026-1633 Synectix LAN 232 TRIO Missing Authentication for Critical Function
The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authentication, allowing unauthenticated users to modify critical device settings or factory reset the device...
CVE-2020-37097
The CVE-2020-37097 entry concerns Edimax EW-7438RPn v1.13. The core issue is an information disclosure vulnerability exposed via the wlencrypt_wiz.asp script, which allows retrieval of sensitive configuration data including the WiFi network name and plaintext password stored in device configurati...
CVE-2025-47399
Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters...
CVE-2026-25484
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input source is in Commerce Product Type setting...
CVE-2026-24434
Shenzhen Tenda AC7 firmware version V03.03.03.01cn and prior does not implement CSRF protections for administrative functions in the web management interface. The interface does not enforce anti-CSRF tokens or robust origin validation, which can allow an attacker to induce a logged-in administrat...
CVE-2026-24434
The CVE-2026-24434 affects Shenzhen Tenda AC7 firmware versions prior to V03.03.03.01_cn. The web management interface is missing anti-CSRF protections and robust origin validation, enabling a logged-in administrator to be induced to perform unintended state-changing requests and modify router se...
CVE-2026-25484
CVE-2026-25484 affects Craft Commerce (Craft CMS) with Stored XSS in Product Type names. Versions 4.0.0-RC1 through 4.10.0 and 5.0.0 through 5.5.1 allow unsanitized input in Commerce Product Type settings to be displayed in the CMS user permissions interface, enabling stored cross-site scripting....
CVE-2026-25484 Craft Commerce has Stored XSS in Product Type Name
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input source is in Commerce Product Type setting...
EUVD-2026-5208
Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input source is in Commerce Product Type setting...
Chrome Zero-Day Vulnerability: Are You Protected?
With billions of users, Google Chrome is more than just a browser; it’s a fundamental part of your organization's attack surface. It’s installed on nearly every endpoint, from the C-suite to the intern pool. This ubiquity is precisely what makes a Chrome zero-day vulnerability so uniquely...
WordPress Buy one click WooCommerce plugin <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import vulnerability
Missing Authorization to Authenticated Subscriber+ Settings Import vulnerability discovered by incognito in WordPress Plugin Buy one click WooCommerce versions = 2.2.9...