EUVD-2026-53041

The ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support plugin for WordPress is vulnerable to SQL Injection via the 'erpadvancefilter' parameter in all versions up to, and including, 1.17.4 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-16143 VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

CVE-2026-18900

A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public...

CVE-2026-18895

A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity5g. Performing a manipulation of the argument cipher results in stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been...

Malicious code in hwi-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db [email protected] ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files...

MAL-2026-12067 Malicious code in hwi-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db [email protected] ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files...

CVE-2026-18856

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

SUSE CVE-2026-54787

sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which can allow an attacker holding expired...

EUVD-2026-52997

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed publicly...

EUVD-2026-52994

Buffer Overflow vulnerability in open62541 v1.5.5 allows a remote attacker to cause a denial of service via the Discovery/LDS handling...

EUVD-2026-52963

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UAClientgetRemoteDataTypes component...

SUSE CVE-2026-66063

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This...

EUVD-2026-53015

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

CVE-2026-18856 Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

CVE-2026-18856 Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

CVE-2026-18856

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

CVE-2026-18856

CVE-2026-18856 affects Poesis Rhymix CMS up to version 2.1.33. The vulnerability resides in the function procImporterAdminCheckXmlFile (modules/importer/importer.admin.controller.php) and enables server-side request forgery via manipulation of the filename argument. Exploitation can be remote; th...

SUSE CVE-2026-67302

FreeRDP before 3.29.0 affected versions = 3.28.0 contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecamdevprocessstartstreamsrequest parses a server-controlled CAMMEDIATYPEDESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not...

SUSE CVE-2026-67306

FreeRDP versions 3.28.0 and earlier contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0-15...

SUSE CVE-2026-67309

Traefik versions = v3.7.0 and = v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware generated from the nginx.ingress.kubernetes.io/rewrite-target annotation. When an Ingress path uses a regex that captures attacker-controlled text...