PT-2026-98362

Name of the Vulnerable Software and Affected Versions Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress versions prior to 4.8.7 Description An issue exists due to missing permission enforcement on the publicly accessible REST route POST...

Linux Distros Unpatched Vulnerability : CVE-2026-67230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesiz...

CVE-2026-14281: Improper Privilege Management

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly accessible REST route POST...

CVE-2026-84463: Improper Neutralization of Input During Web Page Generation

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, a user with Knowledge Base editing rights for a category can embed a video widget in a published answer with a specially crafted value. When the answer is rendered, that value is inserted into the page's HTML...

Asynchronous Python-daphne Unlimited Resource Distribution DoS

The vulnerability of the asynchronous Python-daphne web server is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2026-98826

Name of the Vulnerable Software and Affected Versions D-Link DAP-2610 versions prior to 2.06B08r099 Description An authenticated command injection issue exists within the web interface at the '/index.xgi' endpoint. An attacker with authenticated access can exploit specific parameters to execute...

CVE-2026-96876: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

PT-2026-98909

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description The Web STOMP WebSocket handler fails to enforce max frame size and log...

CVE-2026-93306: Out-of-bounds Read

IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI,...

PT-2026-98862

Name of the Vulnerable Software and Affected Versions IBM Server Firmware versions FW1120.00 through FW1120.01 IBM Server Firmware versions FW1110.00 through FW1110.31 IBM Server Firmware versions FW1060.00 through FW1060.81 IBM Server Firmware versions FW950.00 through FW950.H3 Description A fla...

golang-x-net Package Code Execution

The vulnerability of the golang-x-net package in the Golang programming language is related to the lack of protective measures for web page structures. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-97735: Improper Neutralization of Input During Web Page Generation

ITFlow before 26.08 allows SVG attachments in the ticket email parser cron/ticketemailparser.php for email messages that may arrive over SMTP from arbitrary senders...

CVE-2026-97865: Deserialization of Untrusted Data

A security flaw has been discovered in Open-Web-Analytics up to 1.8.1. Affected is the function Event::loadFromArray of the file queue.php of the component Remote Event Queue Endpoint. Performing a manipulation results in deserialization. The attack can be initiated remotely. Upgrading to version...

WordPress Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin <= 4.8.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Jiemook in WordPress Plugin Wawp versions = 4.8.6...

CVE-2026-48543

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

CVE-2026-48543 Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

EUVD-2026-86448

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

CVE-2026-48543

Krayin CRM versions through 2.2.6 are vulnerable to a stored client-side template injection leading to Cross-Site Scripting (XSS) . The vulnerability exists in the web form description field , where an authenticated attacker can inject Vue.js template expressions using double-brace syntax. When p...

CVE-2026-48543 Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...

CVE-2026-48543 Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a web form...