CVE-2026-8653

The MasterStudy LMS Pro Plus plugin for WordPress is vulnerable to generic SQL Injection via the 'columns' parameter in all versions up to, and including, 4.8.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-41858

The CVE fixes a weakness in Get-RandomPassword within BOSH-Ecosystem’s windows-utilities-release. The password for the Administrator account is derived from a clock-seeded PRNG, allowing a network attacker who can estimate VM boot time to reconstruct a small candidate list and recover the Adminis...

CVE-2026-10737 SP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function

The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the viewfile function in all versions up to, and including, 4.71. This makes it possible for unauthenticated attackers to read file metadata and obtain download links f...

Seagull BarTender 代码问题漏洞

Seagull BarTender is an enterprise-level labeling, barcode, and RFID design and printing software developed by Seagull Corporation in the United States. Versions of Seagull BarTender from 2.1 to 12.1.1 contain code-related vulnerabilities. These vulnerabilities stem from insecure deserialization...

PT-2026-46365

Unauthenticated Local File Inclusion in Snowy = 1.13 versions...

PT-2026-46333

Unauthenticated Local File Inclusion in Iona = 1.0.8 versions...

PT-2026-46340

Unauthenticated Local File Inclusion in Especio = 1.0 versions...

PT-2026-46343

Unauthenticated PHP Object Injection in Plumbing = 1.6 versions...

PT-2026-46323

Unauthenticated Local File Inclusion in Imba = 1.5.0 versions...

PT-2026-46324

Unauthenticated Local File Inclusion in Rosaleen = 2.8 versions...

CVE-2026-35904

Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allows unauthorized attackers to enable the Telnet service via sending a crafted request to a vulnerable CGI component...

PT-2026-46334

Unauthenticated Local File Inclusion in Ingenioso = 1.14.0 versions...

PT-2026-46349

Unauthenticated Arbitrary File Deletion in Car Zone = 3.7 versions...

PT-2026-46354

Unauthenticated Local File Inclusion in Gat = 1.16 versions...

PT-2026-46330

Unauthenticated Local File Inclusion in Nexio = 1.10.0 versions...

PT-2026-46361

Unauthenticated Local File Inclusion in Gamic = 1.15 versions...

PHP 8.5.x < 8.5.7 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.5.7. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.5.7 advisory. - In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal. CVE-2026-44928 - In uriparse...

WordPress plugin MasterStudy LMS Pro Plus SQL注入漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Keystone 安全漏洞

Keystone is a powerful CMS developed by OpenStack. It helps you build and expand faster than any other CMS or application framework. Keystone versions prior to 20260319 have security vulnerabilities. These vulnerabilities stem from unknown code in the...

Strawberry GraphQL 安全漏洞

Strawberry GraphQL is an open-source Python GraphQL library that utilizes type annotations. Versions 0.288.4 to 0.315.3 of Strawberry GraphQL contain security vulnerabilities. These vulnerabilities stem from the GraphiQL template writing values from the header editor into the browser URL query...