CVE-2026-80275

The Comelit Multi-User Gateway for VIP System (model 1456B) is vulnerable in firmware versions 2.9.1 and 2.10.0 due to a failure to enforce server-side authorization on an administrative password-change function. This flaw allows an authenticated user level to invoke the function and overwrite th...

CVE-2026-80276

The Comelit Multi-User Gateway for VIP System (model 1456B) is vulnerable in firmware versions 2.9.1 and 2.10.0 . These versions expose a network-accessible management interface that lacks authentication requirements. A remote, unauthenticated attacker can exploit this to read sensitive device co...

CVE-2026-103542

A server-side request forgery (SSRF) vulnerability exists in formtools.org Form Tools versions up to 3.1.1 . The flaw is located in the AJAX Endpoint component, specifically within the smart_fill function of the /global/code/actions.php file. This vulnerability is triggered by the manipulation of...

CVE-2026-85679

The Extendify plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.1.6 . The root cause is insufficient input sanitization and output escaping of the 'styles.blocks' Block Type Key. Because the registerIncoming() function is hooked on rest_...

CVE-2026-88999

The Redux Framework plugin for WordPress is vulnerable to an authorization bypass in all versions up to and including 4.5.14 . The root cause is a failure to properly verify user authorization for specific actions. Authenticated attackers with subscriber-level access and above can exploit this to...

CVE-2026-103541

A vulnerability exists in formtools.org Form Tools up to version 3.1.1 . The flaw is located in the Ajax Handler component, specifically within the Files::uploadFile function of the global/code/actions.php file. This issue allows for unrestricted upload via a remote attack vector. While the proje...

CVE-2026-67075

HCL Digital Experience is affected by improper input sanitation , which can lead to HTML injection . This vulnerability may be leveraged to perform content spoofing from a trusted domain. To address this issue, users should apply HCL Digital Experience 9.5 CF238 or later. No specific exploit deta...

CVE-2026-103540

A security vulnerability exists in formtools.org Form Tools (versions up to 3.1.1 ) within the Client Settings component. Specifically, the Clients::updateClientSettingsTab function in the file global/code/Clients.class.php fails to properly neutralize special elements used in a template engine w...

CVE-2026-103539

A vulnerability exists in ZongXR SuperMarket 1.0.0.0 within the Instant Buy component. Specifically, the startBuy function in instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java fails to perform proper authentication. By manipulating the Username argument, a ...

CVE-2026-82824

The Hitachi Coding Software Suite (versions through 3.3.0 ) is vulnerable to a Path Traversal vulnerability. This flaw allows an attacker to perform unauthorized actions on the file system, including accessing, creating, modifying, or deleting files . The vulnerability is rated as CRITICAL with a...

CVE-2026-82825

The Hitachi Coding Software Suite (versions through 3.3.0) is vulnerable to a Missing Authentication for Critical Function flaw. This vulnerability allows an unauthenticated attacker to invoke a critical API, which may lead to the unauthorized retrieval or alteration of sensitive information, or ...

CVE-2026-82826

The Hitachi Coding Software Suite (through version 3.3.0 ) contains a vulnerability involving the Cleartext Transmission of Sensitive Information . This flaw allows an attacker to eavesdrop on authentication credentials and other sensitive data while in transit. No specific exploit information or...

CVE-2026-82827

The Hitachi Coding Software Suite (versions through 3.3.0 ) is vulnerable to a Use of Hard-coded Cryptographic Key flaw. The software uses a hard-coded JWT signing secret key , which enables an attacker to generate unauthorized Bearer tokens . By using these fraudulent tokens, an attacker can exp...

CVE-2026-82828

The Hitachi Coding Software Suite (versions through 3.3.0 ) contains an Incorrect Authorization vulnerability. This flaw allows an unprivileged user to perform operations equivalent to those available with administrator privileges . No specific root cause, exploit details, or remediation steps ar...

CVE-2026-82829

The Hitachi Coding Software Suite (affected versions through 3.3.0 ) contains a Hidden Functionality vulnerability. An attacker can exploit hidden accounts or hard-coded credentials to gain unauthorized access without undergoing the legitimate authentication process. The impact is categorized as ...

CVE-2026-76147

A path traversal (ZIP Slip) vulnerability exists in the agent upgrade feature of Genian NAC/ZTNA . The root cause is insufficient authorization and integrity verification , which allows a remote attacker to achieve remote code execution . No specific patch versions or exploit links are provided i...

CVE-2026-76146

Genian SSL PNS is subject to an OS command injection vulnerability. An attacker who possesses only the client access ID , without requiring a password, can execute arbitrary commands remotely. No specific remediation details or exploit links were provided in the documentation.

CVE-2026-76145

An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator privileges . The root cause is the ability to manipulate the permission column during the CSV bulk user registration process, which can also be used to force the creation of an O...

CVE-2026-76144

The Genian SSL PNS software is susceptible to an unrestricted file upload vulnerability. This issue stems from insufficient file extension and integrity verification , which enables an attacker to upload dangerous files to the system. No specific exploit information or remediation details are pro...

CVE-2026-76143

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter. The provided documents do not specify the exact affected version, the specific component or file involved, or the specific remediation steps....