CVE-2026-0770

Langflow is affected by a Remote Code Execution vulnerability (CVE-2026-0770) due to inclusion of functionality from an untrusted control sphere in the exec_globals handling of the validate endpoint. The Nuclei and PoC material indicate the flaw exists in Langflow’s validate_code path (e.g., /api...

CVE-2022-25369

CVE-2022-25369 (Dynamicweb) affects Dynamicweb versions before 9.12.8, where an unauthenticated attacker can create a new administrator account due to a logic flaw in setup phase checks. After becoming the newly created admin, the attacker can upload an executable and achieve command execution (r...

CVE-2023-7335

EduSoho’s CVE-2023-7335 affects versions prior to 22.4.7 and is a remote, unauthenticated arbitrary file-read via the classroom-course-statistics export. The vulnerability arises from path-traversal in the fileNames[] parameter, allowing reading server files such as config/parameters.yml containi...

CVE-2025-67945

CVE-2025-67945 affects the WordPress MailerLite – WooCommerce integration (woo-mailerlite) up to version 3.1.2. The root cause is improper neutralization of special elements in SQL commands (SQL injection) within the plugin, exposing potential unauthorized access to data and impacting confidentia...

CVE-2026-23760

SmarterTools SmarterMail versions before build 9511 are affected by an authentication bypass in the password reset API. The force-reset-password endpoint allows anonymous requests and does not verify the current password or a reset token when resetting system administrator accounts, enabling an u...

CVE-2026-0920

CVE-2026-0920 affects the WordPress plugin “LA-Studio Element Kit for Elementor” (≤ 1.5.6.3). The root cause is a missing role restriction in the AJAX registration handler (ajax_register_handle), which lets unauthenticated users supply the lakit_bkrole parameter and create an administrator accoun...

CVE-2026-20045

Cisco CVE-2026-20045 affects Cisco Unified Communications Manager (including Unified CM SME, IM&P), Unity Connection, and Webex Calling Dedicated Instance. The flaw stems from improper validation of user-supplied input in HTTP requests to the web-based management interface, allowing an unauthenti...

CVE-2026-24061

Summary: CVE-2026-24061 affects GNU Inetutils’ telnetd (up to 2.7) and enables remote authentication bypass by setting the USER environment variable to "-f root". This can lead to unauthorized root access if telnetd is reachable. What’s affected (per provided docs): inetutils telnetd; GNU Inetuti...

CVE-2025-15521

The CVE-2025-15521 entry describes an unauthenticated privilege-escalation in the Academy LMS – WordPress LMS Plugin for Complete eLearning Solution, affecting versions up to 3.5.0. The root cause is improper identity validation during password updates: the reset handler accepts a publicly expose...

CVE-2026-21962

CVE-2026-21962 – Oracle HTTP Server / WebLogic Proxy Plug‑in is documented as a critical, unauthenticated vulnerability affecting Oracle HTTP Server and WebLogic Proxy Plug‑in components. Affected versions include Oracle HTTP Server and WebLogic Proxy Plug‑in for Apache HTTP Server: 12.2.1.4.0, 1...

CVE-2026-1125

CVE-2026-1125 affects D-Link DIR-823X router firmware 250416. The issue resides in the sub_412E7C function within /goform/set_wifidog_settings; manipulating the wd_enable parameter can trigger a remote command injection. Public exploitation appears to be available. Connected sources corroborate t...

CVE-2025-15403

CVE-2025-15403 affects the RegistrationMagic WordPress plugin (versions

CVE-2026-23800

CVE-2026-23800 concerns the Modular DS modular-connector in WordPress Modular DS plugin versions 2.5.2 up to 2.5.9, where an incorrect privilege assignment could enable privilege escalation. Multiple sources (NVD, Red Hat, CVE list, vuln enrichment) confirm the issue and scope: affected product i...

CVE-2026-23744

CVE-2026-23744 affects MCPJam Inspector up to version 1.4.2. The Nuclei template and related sources describe a remote code execution (RCE) vulnerability exploitable via the /api/mcp/connect endpoint. The flaw arises from passing user-controlled input to shell execution, and the service is expose...

CVE-2025-60021

Apache bRPC CVE-2025-60021 is a remote command injection in the heap profiler built-in service (/pprof/heap) affecting all versions

CVE-2021-47795

GeoVision GeoWebServer 5.3.3 is affected by multiple vulnerabilities including Local File Inclusion (LFI), Cross-Site Scripting (XSS), and Remote Code Execution (RCE) through improper input sanitization. The issues can be exploited via the WebStrings.srf endpoint by manipulating path traversal an...

CVE-2023-7334

The CVE-2023-7334 entry affects Changjetong T+ versions up to 16.x. It describes a .NET deserialization vulnerability in an AjaxPro endpoint that allows remote code execution. An attacker can craft a request to /tplus/ajaxpro/Ufida.T.CodeBehind._PriorityLevel,App_Code.ashx?method=GetStoreWarehous...

CVE-2026-23550

CVE-2026-23550 pertains to the Modular DS WordPress plugin (modular-connector) with versions up to and including 2.5.1, where an incorrect privilege assignment creates a broken access control that can lead to privilege escalation. Public documents confirm unauthenticated admin takeover is possibl...

CVE-2025-68947

NSecsoft NSecKrnl is a Windows driver that permits a local, authenticated attacker to terminate processes owned by other users (including SYSTEM and Protected Processes) by sending crafted IOCTL requests. Multiple sources (including Reynolds ransomware and CVE records) describe this as a BYOVD an...

CVE-2026-20931

CVE-2026-20931 is a Windows Telephony Service elevation-of-privilege vulnerability described as external control of a file name or path. The connected sources confirm the affected component as Windows Telephony Service and the issue enables an attacker on an adjacent network to obtain increased p...