2125 matches found
CVE-2026-84043
The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...
EUVD-2026-70992
The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...
CVE-2026-85147
SmartIT Desktop Manager developed by Lightstar contains a hard-coded credentials vulnerability. An unauthenticated remote attacker can extract a specific password from the source code and use it to retrieve the AES encryption key used for communication, resulting in a high confidentiality impact ...
EUVD-2026-70868
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code...
CVE-2026-85146
SmartIT Desktop Manager by Lightstar contains a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code. This exposes the agent's SSH service account ...
EUVD-2026-71741
Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational...
CVE-2021-44319
Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to a Wi-Fi deauthentication attack that allows a remote, unauthenticated attacker to disconnect the drone from its controller during mid-flight, resulting in a Denial of Service . The vulnerability is rated CVSS 7.5 (HIGH) with a network attack vect...
EUVD-2026-71443
Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...
CVE-2026-75170
This stored XSS affects the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1 ). A remote unauthenticated attacker can inject arbitrary JavaScript by manipulating the language POST parameter , causing the application's response to execute attacker-controlled script in the ...
...[ More ]
A stack-based buffer overflow vulnerability exists in the redirect CGI program distributed with thttpd. The vulnerability is caused by unsafe string concatenation when constructing redirect URLs using attacker-controlled CGI environment variables. A remote, unauthenticated attacker can trigger th...
CVE-2026-85150
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length...
PT-2026-85699
CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: https://t.co/2JPeD1RjLr CVE infosec XSS valtersit snippet infosec SysAdmin cybersecurity...
UBUNTU-CVE-2026-84963
An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticat...
CVE-2026-79390
Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational...
EUVD-2021-34874
Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106166)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106166 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server:...
CVE-2026-85391 Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml
Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...
CVE-2026-84773 WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
CVE-2026-80465
CVE-2026-80465 affects the Mendix SAML module across multiple compatibility lines: Mendix 10 (all versions < V4.2.3), Mendix 11 (all versions < V4.2.3), and Mendix 9.24 (all versions
CVE-2026-85150
CVE-2026-85150 is a NULL pointer dereference in GStreamer's RTSP support library, specifically in gst_rtsp_message_parse_auth_credentials() (part of gst-plugins-base). A specially crafted whitespace placement in a Digest Authorization or WWW-Authenticate header causes an internal length calculati...