211 matches found
Masteriyo LMS <= 1.7.2 - Unauthenticated Privilege Escalation
The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the updateloggedinuser function in all versions up to, and including, 1.7.2. This makes it possible for unauthenticated attackers t...
CVE-2022-24637
CVE-2022-24637 Open Web Analytics 1.7.3 - 远程代码执行利用工具 v2 针对 Open Web Analytics 1.7.3 - RCE 的有效利用工具，集成了 pentestmonkey 的 php 反弹 shell，修复了无法在缓存中找到用户的问题。 原始利用代码可在 此处 找到。 使用方式 在 php-reverse-shell.php 文件中填写攻击机 IP 和端口，然后使用 -u 参数指定目标漏洞 URL 运行 exploit.py。 root@kitploit: python3 exploit.py -u...
EUVD-2026-53670
Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper when processing PublishResponse EventNotificationList data...
CVE-2026-67866
Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMacProcessMsgDeleteMonitoredItemsResponse and SOPCStaMacNewDeleteMonitoredItems in the client wrapper DeleteMonitoredItems path...
CVE-2026-67865
S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling. This allows a remote attacker to cause a denial of service...
CVE-2026-67872
Technical details about CVE-2026-67872 are not publicly available in the provided documents (no affected versions beyond 1.7.3, no root cause, impact specifics, or fix information). Monitor for updates.
CVE-2026-67867
Systerel S2OPC 1.7.3 is affected by a Buffer Overflow vulnerability in the Alarm/Conditions wrapper when processing PublishResponse EventNotificationList data. The issue can be triggered remotely to cause a denial of service. The available documents confirm the affected product/version and the un...
CVE-2026-67866
Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMacProcessMsgDeleteMonitoredItemsResponse and SOPCStaMacNewDeleteMonitoredItems in the client wrapper DeleteMonitoredItems path...
CVE-2026-67872
An issue in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the event monitored-item queue resize handling...
CVE-2026-67871
Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, addressspacebs.c, sopcnodemgthelperinternal.c, and toolkittestserver...
EUVD-2026-52808
A weakness has been identified in Systerel S2OPC up to 1.7.3. This affects the function LockedStaMacProcessMsgDeleteMonitoredItemsResponse of the file src/ClientServer/frontend/clientwrapper/internal/statemachine.c of the component DeleteMonitoredItemsRequest Handler. This manipulation causes...
CLSA-2026-1784683086 TuxCare security update for shell-quote (3 CVEs)
TuxCare rebuilt shell-quote to address 3 CVEs. Fixed in 1.7.3-tuxcare.1...
CLSA-2026-1775003170 TuxCare security update for node-fetch (3 CVEs)
TuxCare rebuilt node-fetch to address 3 CVEs. Fixed in 1.7.3-tuxcare.1...
CVE-2026-57794
Technical details about CVE-2026-57794 are not provided in connected documents. The initial description states a PHP Local File Inclusion in Golo Framework
CVE-2026-57794
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in uxper Golo Framework golo-framework allows PHP Local File Inclusion.This issue affects Golo Framework: from n/a through = 1.7.3...
CVE-2026-57794 WordPress Golo Framework plugin <= 1.7.3 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in uxper Golo Framework golo-framework allows PHP Local File Inclusion.This issue affects Golo Framework: from n/a through = 1.7.3...
CVE-2026-61426 PraisonAI before 1.7.3 Unauthenticated Agent Access via Insecure Defaults
PraisonAI before 1.7.3 contains an insecure default configuration that binds to all interfaces with no API key requirement and wildcard CORS. Unauthenticated attackers can call GET /api/agents to read agent instructions and system prompts, or POST /api/chat to invoke agents without authentication...
PYSEC-2026-887 OctoPrint does not have rate limiting on the login page
OctoPrint 1.7.3 and prior does not have rate limiting on the login page, making it possible for attackers to attempt brute force attacks. The severity of this issue is limited by OctoPrint normally running in a restricted LAN. The devel and maintenance branches of the repository have a fix that...
