Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal

Schneider Electric Pelco VideoXpert Enterprise versions 2.0 and prior contain a directory traversal caused by insufficient input validation, letting unauthorized persons view web server files, exploit requires no authentication. id: CVE-2017-9965 info: name: Schneider Electric Pelco VideoXpert...

WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access

WordPress Welcart e-Commerce plugin before 2.8.5 is susceptible to arbitrary file access. The plugin does not validate user input before using it to output the content of a file, which can allow an attacker to read arbitrary files on the server, obtain sensitive information, modify data, and/or...

kkFileview v4.0.0 - Local File Inclusion

kkFileview v4.0.0 is vulnerable to local file inclusion which may lead to a sensitive file leak on a related host. id: CVE-2021-43734 info: name: kkFileview v4.0.0 - Local File Inclusion author: arafatansari severity: high description: | kkFileview v4.0.0 is vulnerable to local file inclusion whi...

JS Help Desk <= 2.8.1 - SQL Injection

The JS Help Desk – Best Help Desk & Support Plugin plugin for WordPress is vulnerable to SQL Injection via the 'email' and 'trackingid' parameters in all versions up to 2.8.2 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S...

Apache HTTPd Windows UNC - Server-Side Request Forgery

SSRF in Apache HTTP Server on Windows allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. Note- Existing configurations that access UNC paths will have to configure new...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to weaker than expected security controls in IBM WebSphere Application Server Liberty (CVE-2025-14923)

Summary IBM Storage Protect Client and Virtual Environments include IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in the Liberty Security Utility could result in weaker than expected security controls during security administration. IBM Storage...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are affected by weaker than expected security in IBM WebSphere Application Server Liberty (CVE-2025-14917)

Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings. IBM Storag...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to privilege escalation due to IBM WebSphere Application Server Liberty (CVE-2025-14915)

Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. A privilege escalation vulnerability in IBM WebSphere Application Server Liberty, when the restConnector-1.0 or restConnector-2.0 feature is enabled,...

Security Bulletin: IBM Storage Protect Client and Virtual Environments are vulnerable to server-side request forgery due to IBM WebSphere Application Server Liberty (CVE-2026-1561)

Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could allow a remote authenticated attacker to perform server-side request forgery SSRF,...

Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction

Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic ACC, its enterprise-focused marketing automation platform, that could result in arbitrary code execution. The vulnerability, tracked as CVE-2026-48449 , carries a severity score of 10.0 on the CVSS...

Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware

A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake , a remote access trojan RAT that can capture webcam images, microphone audio, and keystrokes, Microsoft said in its latest report. Researchers track the operation as CaptiveCrunch and attribute it to...

Tianwen-ERP-Upload-PoC

Tianwen Property ERP — Unauthenticated File Upload CVE: P...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse http2-common library that could cause resource exhaustion (CVE-2025-5115).

Summary IBM Storage Protect Server uses the Eclipse http2-common library in certain components. A vulnerability in http2-common could cause malicious client to repeatedly send malformed or invalid HTTP/2 frames, forcing the server to generate excessive RSTSTREAM responses. This can result in...

Security Bulletin: Multiple vulnerabilities in IBM Db2 may affect IBM Storage Protect Server (CVE-2025-36384, CVE-2025-58056, CVE-2024-47072).

Summary IBM Storage Protect Server, which uses IBM Db2, may be affected by multiple vulnerabilities that could result in denial of service or the loss of confidentiality, integrity. These vulnerabilities include CVE-2024-47072, CVE-2025-36442, CVE-2025-36428, CVE-2025-36427, CVE-2025-36424,...

Security Bulletin: IBM Storage Protect Client is vulnerable to denial-of-service attack due to commons-lang-2.6.jar (CVE-2025-48924)

Summary Apache Commons lang 2.6 library is used by the IBM Storage Protect Client, BA Client and Data Protection for VMware component. An uncontrolled recursion flaw in ClassUtils.getClass can cause a StackOverflowError when processing specially crafted long inputs, potentially resulting in a...

Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site scripting due to Angular (CVE-2026-22610)

Summary IBM Storage Protect Client uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to execute arbitrary JavaScript by exploiting insufficient sanitization of href and xlink:href attribut...

Security Bulletin: IBM Storage Protect Client is vulnerable to stored cross-site scripting due to Angular (CVE-2025-66412)

Summary IBM Storage Protect Client uses the Angular web framework to provide web-based user interface components. A stored cross-site scripting XSS vulnerability in the Angular Template Compiler could allow an attacker to bypass Angular's built-in security sanitization and execute malicious scrip...

Security Bulletin: IBM Storage Protect Client is vulnerable to cross-site scripting due to Angular (CVE-2026-27970)

Summary IBM Storage Protect Client uses Angular to provide web-based user interface components. A cross-site scripting XSS vulnerability in the Angular internationalization i18n pipeline could allow attacker-controlled JavaScript to execute if a malicious translation file is processed. Successful...

openSUSE 16 Security Update : perl-Mojolicious (openSUSE-SU-2026:21496-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21496-1 advisory. Changes in perl-Mojolicious: - updated to 9.480.0 9.48 - Fixed a security issue where CSRF tokens were vulnerable to BREACH attacks. Tokens are now mask...

openSUSE 16: openssh / openssh-askpass-gnome / openssh-cavs / openssh-clients / etc (openSUSE-SU-2026:21477-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21477-1 advisory. - CVE-2026-59995: sftp: location of downloaded files not properly constrained when sftp server:/path . is used with an attacker-controlled serve...