CVE-2026-44943

CVE-2026-44943 is a path traversal in open-iscsi up to commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e, allowing remote MITM attackers to create root-owned files outside the database and inject lines into the record. Affected product: open-iscsi. Root cause: improper limitation of a pathname to a...

CVE-2026-65553

CVE-2026-65553 is backed by a connected doc reporting a Remote Code Execution (RCE) vulnerability in the WordPress plugin Spider Analyser (WordPress Spider Analysis plugin) for versions

CVE-2026-33385

Quick.CMS 6.8 is affected by a Blind SQL injection in the administration panel, resulting from improper neutralization of input fields accessed by a high-privileged user. The vulnerability can bypass front-end validation controls and potentially lead to database destruction. The CVSS-derived metr...

CVE-2026-65944

The CVE-2026-65944 entry concerns the Joomla Extension rolandd.com CSVI, where CSRF vulnerabilities exist in AJAX endpoint handlers. Affected: CSVI versions before 9.11.0. Impact, per metrics: high confidentiality, integrity, and availability impact (C/H, I/H, A/H) with CVSS v3.1 base score 8.8. ...

CVE-2026-65943

Joomla Extension RO CSVI by rolandd.com (

CVE-2026-65946

CVE-2026-65946 : Joomla extension rolandd.com RO CSVI is vulnerable to XSS in AJAX endpoint handlers in versions

CVE-2026-50641

Streamsoft Business Intelligence (BI) stores users’ passwords in plaintext in the database. The issue is mitigated in version 6.8.0.0, and users were also prompted to change their password on first login. Impact is Confidentiality (high) with no reported impact to integrity or availability. The a...

CVE-2026-12927

The CVE-2026-12927 issue affects IGSS Definition SCADA, specifically the Def.exe component. The connected sources describe a vulnerability consistent with a memory corruption problem (buffer overflow / out-of-bounds write) that could allow arbitrary code execution when a malicious CGF file is imp...

CVE-2026-65891

Affected software: Joomla Extension - joomlacontenteditor.net, Joomla Content Editor (JCE) prior to 2.20.2. Root cause: improper input validation in the file rename functionality, allowing an authenticated user with file-management permissions to rename files to invalid names, resulting in hidden...

CVE-2026-66688

CVE-2026-66688 is linked to a Cross Site Scripting (XSS) vulnerability in the WordPress plugin Ultimate Addons for Elementor , reported for versions

CVE-2026-0667

CVE-2026-0667 affects Schneider Electric SCADAPack RTUs (47xi, 47x, 57x) and RemoteConnect software. Root cause: insufficient testing of unusual or exceptional states. Attack over Modbus TCP could enable arbitrary code execution, DoS, and loss of confidentiality/integrity with high impact on conf...

CVE-2026-66692

The CVE-2026-66692 entry is reserved, but a connected document reports an Insecure Direct Object References (IDOR) vulnerability in WordPress Plugin Colissimo Officiel : Méthodes de livraison pour WooCommerce, versions

CVE-2026-66696

The Connected document identifies CVE-2026-66696 as a vulnerability in the WordPress plugin Gutenberg Blocks by Kadence Blocks (WordPress plugin) with versions

CVE-2026-65884

Product: Joomla Extension Gridbox (balbooa.com). Vulnerability: Privilege Escalation in Gridbox

CVE-2026-65885

CVE-2026-65885 affects the Joomla extension Gridbox from balbooa.com prior to version 2.20.2. The vulnerability enables authenticated arbitrary file upload via its file upload methods, and can lead to authenticated remote code execution when paired with CVE-2026-65884, which reportedly enables th...

CVE-2020-33519

Technical details for CVE-2020-33519 are not publicly available in the provided documents. No affected products, versions, or exploit information are present. Monitor for updates.

CVE-2026-16475

CVE-2026-16475 is evidenced by a PoC for OCSinventory (OCS Inventory NG) where Local File Inclusion exists in the /ajax/teledeployoptions.php endpoint due to improper sanitization of the linkedoptions parameter. Affected version in the exploit is 2.12.4, with unauthenticated remote attacker able ...

CVE-2026-25886

Technical details for CVE-2026-25886 are not publicly available in the provided documents. Monitor for updates as information remains unavailable in the supplied sources.

CVE-2022-36162

Technical details for CVE-2022-36162 are not publicly available in the provided documents; no affected products, impact, or remediation are disclosed. Monitor for updates from connected sources.

CVE-2022-45265

Technical details for CVE-2022-45265 are not publicly available in the provided documents. Current entries indicate reservation with no public specifics. Monitor for updates from official advisories or credible repositories before drawing conclusions about impact or remediation.

CVE-2023-999993

Technical details are not publicly available in the provided documents. Monitor for updates and new disclosures.

CVE-2023-999992

Technical details for CVE-2023-999992 are not provided in the supplied documents. No affected products, impact, or remediation are shown. Monitor for updates.

CVE-2023-999991

Technical details for CVE-2023-999991 are not publicly available in the provided documents. No information on affected products, root cause, impact, or fixes is present. Monitor for updates from official sources.

CVE-2023-28615

Technical details for CVE-2023-28615 are not publicly provided in the supplied documents. No affected products, vulnerable components, root cause, or remediation are described here. Monitor for updates.

CVE-2023-31443

CVE-2023-31443 is evidenced by a GitHub exploit describing a local directory traversal/ race condition in the NorduGrid arc package. Specifically, nordugrid-arc-wn 6.14.0 contains the arc-job-cgroup SUID binary with a vulnerable main() path where ncopied = snprintf(cgroup_path, FILENAME_MAX, "%s%...

CVE-2023-31711

CVE-2023-31711 shows up in connected data via a GitHub exploit note for ZKTECO devices. The root cause is reported as incorrect access control in the administrative API, enabling remote attackers to read arbitrary files via the API. The included exploit description demonstrates commands like get_...

CVE-2023-10608

Technical details about CVE-2023-10608 are not publicly available in the provided documents. Monitor for updates from official advisories.

CVE-2023-36544

Technical details for CVE-2023-36544 are not provided in the supplied documents; no affected products, impact, or fixes are specified. Monitor for updates.

CVE-2023-66975

Technical details for CVE-2023-66975 are not publicly available in the provided documents. Monitor for updates from CIRCL or other advisories.

CVE-2023-34584

Technical details for CVE-2023-34584 are not publicly available in the provided documents. The entry appears reserved. Monitor for updates as information may be released later.

CVE-2023-37778

Technical details for CVE-2023-37778 are not publicly available in the provided documents. Monitor for updates.

CVE-2023-37779

Technical details for CVE-2023-37779 are not publicly available in the provided documents; no affected products, versions, or mitigations are specified. Monitor for updates as new information appears.

CVE-2023-38821

Technical details for CVE-2023-38821 are not publicly available in the provided documents; monitor for updates as future disclosures may add affected products, impact, or remediation.

CVE-2023-38820

CVE-2023-38820 is evidenced by a GitHub exploit targeting Slack v4.33.73, enabling local arbitrary code execution via DLL loading. The issue arises through loading of multiple DLLs (profapi.dll, CRYPTBASE.dll, KBDUS.DLL, DPAPI.dll, MSASN1.dll, mf.dll, mfplat.dll, RTWorkQ.DLL) where a malicious DL...

CVE-2023-38822

Technical details for CVE-2023-38822 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-14354

CVE-2026-14354 concerns Schneider Electric’s EcoStruxure Cybersecurity Admin Expert (CAE) software, where insufficient protection of registration data and stored credentials can enable a local privileged attacker to bypass authentication and modify credentials, potentially compromising managed de...

CVE-2026-14270

Affected product: Extra Checkout Options addon for Extra Product Options & Add-Ons for WooCommerce (WordPress). Vulnerability: Arbitrary File Upload in all versions up to 2.3.2 due to missing authorization and nonce validation in eco_save_settings, enabling low-privileged authenticated users to m...

CVE-2026-66699

The connected document reports a Broken Access Control vulnerability in the WordPress plugin Dokan (versions

CVE-2026-12895

CVE-2026-12895 affects ERPNext 15.107.0 and Frappe 15.107.2. The flaw arises from constructing SQL queries via direct string interpolation (str.format()) instead of parameterized queries, allowing an authenticated user with low privileges to inject SQL through a Supplier record name (docname). Ex...

CVE-2026-66701

The connected Patchstack entry identifies a Broken Access Control vulnerability in the WordPress Plugin Profile Builder, affecting versions

CVE-2026-66703

The connected PATCHSTACK entry documents a Cross Site Scripting (XSS) vulnerability in the WordPress MailOptin plugin for versions

CVE-2026-18220

The CVE-2026-18220 vulnerability affects the GNU binutils BFD library’s DLX ELF backend (source file bfd/elf32-dlx.c). The root cause is an insufficient bounds check in dlx_rtype_to_howto() on ELF32_R_TYPE(r_info) before indexing into dlx_elf_howto_table[], despite non-contiguous DLX relocation t...

CVE-2026-50642

CVE-2026-50642 — diff-so-fancy exposes non-SGR terminal control sequences in diff output, not sanitizing characters like CR and OSC/CSI. An attacker can place malicious control sequences in filenames, diff metadata, or file content, which render in the terminal during diff viewing and may cause o...

CVE-2026-56390

GNU Bison is affected by CVE-2026-56390 through grammar-defined output directives (%output, %header), which can accept unrestricted file paths and override caller-supplied output options. When processing attacker-supplied grammar, this allows writing generated files to arbitrary writable location...

CVE-2026-56389

CVE-2026-56389 : GNU Bison suffers an arbitrary command execution in HTML report generation. The root cause is improper handling of grammar-defined configuration variables: a grammar file can override the executable used for the XML-to-HTML step via %define tool.xsltproc, which is passed directly...

CVE-2026-65883

CVE-2026-65883 affects Joomla extensions: aimy-extensions.com ’s Captcha-Less Form Guard versions 18.0–20.0 . The issue is a PHP object injection in a forged clfgd field, leading to remote code execution . The root cause and impact are described as RCE with high severity. No explicit exploit deta...

CVE-2026-8791

CVE-2026-8791 affects the Booking System Trafft WordPress plugin (versions up to 1.0.17). A missing capability check in the set_options AJAX handler (in agency mode) allows authenticated users with Subscriber+ to update the trafft_option with a bookingWebsiteUrl value, enabling the plugin to enqu...

CVE-2026-6089

The WP CTA plugin for WordPress (all versions up to 2.1.2) is vulnerable to Server-Side Request Forgery via the sticky_s_media parameter in imported JSON. The import_sidebars() function passes user-supplied URLs to file_get_contents() after only FILTER_VALIDATE_URL validation, allowing internal I...

CVE-2026-14488

CVE-2026-14488 affects the Meta Box AIO WordPress plugin (MB Frontend Submission extension) up to version 3.8.0. The vulnerability stems from handle_request() routing the mbfs_delete action without capability/ownership checks, and nonce verification in check_ajax() being gated behind is_ajax(), w...

CVE-2026-5060

The CVE describes a vulnerability in the MasterStudy LMS WordPress Plugin (for Online Courses and Education) version up to 3.7.14. The issue is an Insecure Direct Object Reference in the stm_lms_delete_cover() function, which lacks ownership validation on the file_id parameter before calling wp_d...