CVE-2026-108105

The Open5GS software (versions through 2.8.0 ) is vulnerable to a reachable assertion vulnerability within the mme_gn_handle_sgsn_context_request() function. A remote unauthenticated attacker can exploit this by sending malformed SGSN Address IEs via GTPv1-C traffic from a configured SGSN address...

CVE-2026-108103

Versions of Open5GS through 2.8.0 are vulnerable to a heap out-of-bounds read in the ogs_pfcp_parse_dropped_dl_traffic_threshold() function. This flaw allows remote unauthenticated attackers to read past IE buffers by sending PFCP Session Establishment or Modification Requests to the UPF on UDP p...

CVE-2026-108102

The Open5GS project (versions through 2.8.0 ) contains a heap out-of-bounds read vulnerability within the ogs_pfcp_parse_volume_measurement() function in lib/pfcp/types.c. This flaw allows remote unauthenticated attackers to read past Information Element (IE) buffers by sending a PFCP Session Rep...

CVE-2026-108101

HortusFox (hortusfox-web) versions through 6.3 contain an unrestricted file upload vulnerability within the PlantAttachmentModel component. This flaw allows authenticated users to upload files with client-supplied extensions to the public/attachments/ directory via the /plants/attachments/add end...

CVE-2026-108100

HortusFox (hortusfox-web) before version 6.2 is vulnerable to an SQL injection flaw within the /api/locations/list endpoint. The root cause is located in PlantsModel::getSpecificInfo() , which insecurely concatenates user-supplied include_info values into the SQL column list. This allows authenti...

CVE-2026-105278

The Grid Protection Alliance openPDC (Docker image) is affected by a Use of Hard-coded Credentials (CWE-798) vulnerability. The published Docker image contains a fixed administrative credential that does not require a password change upon first use. An attacker with network access to the manageme...

CVE-2026-94067

The Fuelthemes The Voux WordPress theme (versions ≤ 6.9.5 ) is vulnerable to a PHP Local File Inclusion (LFI) flaw. The root cause is the Improper Control of Filename for Include/Require Statement in PHP Program (CWE-98). While the specific component or function is not detailed in the provided do...

CVE-2026-94063

The ThemeREX Education Center WordPress theme is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw due to the improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 3.6.12 . Exploitation details are not provided in the documents, ...

CVE-2026-94065

The BuddhaThemes ColorFolio WordPress theme (versions

CVE-2026-94064

The BuddhaThemes Neo | Barber Shop WordPress Theme (neocut) is vulnerable to PHP Object Injection due to the Deserialization of Untrusted Data (CWE-502). This vulnerability affects versions up to and including 3.5 . Successful exploitation can lead to significant impacts on confidentiality , inte...

CVE-2026-94066

The WordPress Pond theme (versions

CVE-2026-104629

The openPDC and openHistorian software products are vulnerable to unsafe reflection due to a flaw in their component loading mechanism. The system will construct and execute any specified type, which can be exploited to run arbitrary constructor code . An attacker with authenticated user account ...

CVE-2026-101022

The openPDC software is vulnerable to a Server-Side Request Forgery (SSRF) issue within its Modbus connection feature. The software accepts caller-specified destination addresses and ports without restricting which internal hosts can be targeted. An authenticated user can exploit this to attempt ...

CVE-2026-85479

The Grid Protection Alliance openPDC and openHistorian software products are affected by CVE-2026-85479 . The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. This allows an unauthenticated network attacker to connect to the int...

CVE-2026-105281

The Grid Protection Alliance openPDC software is vulnerable to missing authentication for a critical function. Specifically, the internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to t...

CVE-2026-100730

The Grid Protection Alliance openPDC and openHistorian software products contain a vulnerability in their service console interface. The flaw allows for the deserialization of untrusted data from a client-supplied data structure. On systems without Windows Authentication, an unauthenticated netwo...

CVE-2026-106581

Before version 4.92.0 , Docker Desktop for Windows failed to verify the cryptographic signature of packages provided via the Docker Desktop Installer.exe install -package command. This vulnerability allows an attacker who can provide a crafted package and convince a user to approve a Docker-signe...

CVE-2026-107803

The open-source workflow management software ProcessMaker is vulnerable to SQL injection in the GET /api/1.0/tasks endpoint prior to version 2026.14.3 . The root cause is located in ProcessMaker raits askcontrollerindexmethods::applycolumnordering(), where the application concatenates a user-cont...

CVE-2026-108063

A null pointer dereference vulnerability exists in libhangul within the hanja_new() function. The flaw occurs because the library fails to verify that a Hanja dictionary entry contains a valid value alongside its key when parsing files. An attacker can provide a specially crafted dictionary file ...

CVE-2026-92085

The Talassoft Industrial Management Software by TMT Machinery Industry and Trade Co. Ltd. contains a Stored XSS vulnerability (CWE-79) caused by improper neutralization of input during web page generation. This issue affects versions before V16.0.1 . Attackers could potentially execute malicious ...