CVE-2026-22679

Weaver E-cology 10.0 (prior to build 20260312) is affected by CVE-2026-22679. The flaw is an unauthenticated RCE exposed at /papi/esearch/data/devops/dubboApi/debug/method, where attacker-controlled interfaceName and methodName parameters trigger command-execution via the Dubbo RPC layer. Exploit...

CVE-2021-4473

CVE-2021-4473 affects the Tianxin Internet Behavior Management System. A command-injection flaw exists in the Reporter component endpoint, allowing unauthenticated attackers to supply an objClass parameter containing shell metacharacters and output redirection to execute arbitrary commands. This ...

CVE-2026-34197

The CVE-2026-34197 issue affects Apache ActiveMQ products (Broker, All, and Core) before 5.19.4 and before 6.2.3 (6.0.0–6.2.3 range). The root cause is improper input validation and insecure control of code generation via the Jolokia JMX-HTTP bridge, which can be abused to load a remote Spring XM...

CVE-2026-0740

CVE-2026-0740 affects the WordPress plugin Ninja Forms File Uploads (≤ v3.3.26). The vulnerability is unauthenticated arbitrary file upload due to missing file type validation in NF_FU_AJAX_Controllers_Uploads::handle_upload, enabling an attacker to upload and potentially execute code on the serv...

CVE-2026-35616

Fortinet FortiClient EMS is vulnerable to CVE-2026-35616 in versions 7.4.5 and 7.4.6. The issue is an improper access control where Django middleware also trusts HTTP headers (X-SSL-CLIENT-VERIFY, X-SSL-CLIENT-S-DN, X-SSL-CLIENT-SERIAL) for certificate-derived authentication, enabling an unauthen...

CVE-2026-2699

CVE-2026-2699 affects Progress ShareFile Storage Zones Controller (SZC). An unauthenticated attacker can bypass authentication to access restricted configuration pages (notably via the Admin.aspx path), enabling changes to system configuration and potentially enabling remote code execution. The i...

CVE-2026-29014

CVE-2026-29014 affects MetInfo CMS versions 7.9, 8.0, and 8.1 with an unauthenticated PHP code injection that enables remote code execution. The vulnerability arises from insufficient input neutralization in the execution path, allowing remote attackers to send crafted requests containing PHP cod...

CVE-2026-5281

CVE-2026-5281 is a use-after-free in Dawn (Chromium’s graphics layer/WebGPU) affecting Google Chrome versions prior to 146.0.7680.178. A remote attacker who has gained control of the renderer process can execute arbitrary code via a crafted HTML page. Publicly available Chromium/Chrome advisories...

CVE-2026-35056

Summary (supported by connected docs): XenForo versions before 2.3.9 and before 2.2.18 are affected by a remote code execution (RCE) vulnerability exploitable by authenticated, malicious admins who have access to the admin panel. The attacker can execute arbitrary code on the server. The referenc...

CVE-2026-3300

CVE-2026-3300 affects Everest Forms Pro for WordPress (versions

CVE-2026-4020

Gravity SMTP for WordPress versions up to 2.1.4 exposes a REST endpoint at /wp-json/gravitysmtp/v1/tests/mock-data whose permission_callback always returns true, allowing unauthenticated access. When the ?page=gravitysmtp-settings parameter is used, register_connector_data() populates internal da...

CVE-2026-3502

The CVE-2026-3502 issue affects TrueConf Client where the update payload is downloaded and installed without integrity verification, allowing an attacker who controls the update path to substitute a tampered payload and potentially achieve arbitrary code execution in the updater process or user c...

CVE-2026-33032

CVE-2026-33032 affects nginx-ui prior to 2.3.4. The MCP integration exposes two HTTP endpoints: /mcp (protected by AuthRequired) and /mcp_message (no authentication). The default IPWhiteList is empty, which the middleware treats as “allow all,” enabling unauthenticated MCP tool invocations (e.g.,...

CVE-2026-5027

Langflow

CVE-2026-1890

CVE-2026-1890 concerns the WordPress plugin LeadConnector prior to 3.0.22. The issue is an unauthenticated REST route that lacks proper authorization, allowing unauthenticated callers to invoke the route and overwrite existing data. The CVSS 3.1 base score is 5.3 (Medium), with network attack vec...

CVE-2025-15488

CVE-2025-15488 affects the WordPress plugin Responsive Plus (versions before 3.4.3). Affected component: the plugin’s AJAX action update_responsive_woo_free_shipping_left_shortcode. Root cause: unauthenticated inputs to content_rech_data are not properly validated before processing as a shortcode...

CVE-2026-2931

The CVE-2026-2931 entry concerns the Amelia Booking plugin for WordPress (versions up to and including 9.1.2). The vulnerability is an Insecure Direct Object Reference that allows a user-controlled access to objects, enabling authenticated users with customer-level permissions or higher to change...

CVE-2026-25455

CVE-2026-25455 is a Missing Authorization vulnerability in PickPlugins Product Slider for WooCommerce (woocommerce-products-slider). Affected versions cover Product Slider for WooCommerce up to 1.13.61. The issue arises from incorrectly configured access control, enabling unauthorized access to a...

CVE-2026-25306

CVE-2026-25306 corresponds to a Reflected XSS in XStore Core et-core-plugin (WordPress). Affected: XStore Core

CVE-2026-33497

Langflow before 1.7.1 is affected by a path traversal in GET /profile_pictures/{folder_name}/{file_name} where folder_name and file_name are not strictly filtered, allowing an attacker to read the secret_key across directories. A patch was released in version 1.7.1; upgrading to 1.7.1 or newer mi...