CVE-2026-104082

SmarterMail before Build 9777 is vulnerable to Remote Code Execution (RCE) due to a bypass of the Volume Mount script-directory containment control . An attacker with a SysAdmin-scoped access token can provision a new mail domain via the domain-put endpoint, setting an arbitrary FileStore root pa...

CVE-2026-108112

The ruoyi-ai software, versions 3.0.0 through 3.1.0 , is vulnerable to a missing authorization flaw (CWE-862). Authenticated users can delete workflows belonging to other users via the POST /workflow/del/{uuid} endpoint. The root cause is that the softDelete() function fails to invoke the Privile...

CVE-2026-108113

The ILIAS learning management system versions prior to 9.24, 10.12, and 11.5 are vulnerable to an unrestricted file upload vulnerability within the QTI question import image handling component (ilQtiMatImageSecurity ). Authenticated authors with question pool import rights can exploit this by imp...

CVE-2026-108111

The software ruoyi-ai versions 3.0.0 through 3.1.0 is vulnerable to a missing authorization vulnerability in the GET /workflow/search endpoint. The root cause is a lack of owner or is_public filtering, allowing authenticated non-admin users to query and list enabled private workflows within the s...

CVE-2026-108110

The MOVO application (versions through 0.2.3 ) contains an authorization bypass vulnerability within the chat-api document endpoints. The root cause allows authenticated users to access other users' stored objects by supplying arbitrary object paths . Specifically, an attacker who knows a target'...

CVE-2026-107807

The Nginx UI web interface (versions 2.0.0 through 2.5.0 ) is vulnerable to Node Secret Credential Exposure because it accepts the Node.Secret master credential via the node_secret URL query parameter. This occurs instead of requiring the X-Node-Secret header, potentially exposing the secret in a...

CVE-2026-107806

The Nginx UI web user interface (versions 2.3.8 until 2.5.0 ) is vulnerable to Remote Code Execution due to an insecure backup restoration flow. An authenticated administrator with an active secure session can submit attacker-controlled backup key material and a manifest via POST /api/restore . T...

CVE-2026-108125

The wp-post-author plugin is vulnerable to an SQL injection flaw due to the improper neutralization of special elements used in an SQL command. This security issue specifically affects wp-post-author version 4.0.0 prior to 4.1.0 . Exploitation of this vulnerability may result in high confidential...

CVE-2026-15340

The Savannah lwIP SMTP client (specifically version v2.2.1 ) is vulnerable to a classic buffer overflow because it fails to perform adequate size checks on inputs. This vulnerability could allow an attacker to crash the affected device or achieve remote code execution . Impacted systems are often...

CVE-2026-108124

The wp-post-author plugin, specifically versions before 4.1.0 , is vulnerable to an authenticated SQL injection (CWE-89). The root cause is the improper neutralization of special elements used in an SQL command. This vulnerability allows an attacker with high privileges to impact confidentiality ...

CVE-2026-107805

The Nginx UI web user interface is vulnerable to a resource exhaustion flaw in versions 2.5.0 through 2.6.0 . The root cause lies in the node-signature authentication path , which stages an attacker-controlled request body into a temporary file and synchronizes it before validating the cryptograp...

CVE-2026-107804

The Nginx UI web user interface for the Nginx web server is vulnerable in versions 2.2.0 through 2.6.0 due to a missing trusted proxy configuration in its bundled reverse proxy. This flaw causes the backend to fail to preserve external client identities, attributing management requests to the loo...

CVE-2026-95702

A use-after-free vulnerability exists in the VFS component of Google gVisor prior to release 20260831.0 on all platforms. A local attacker with standard container privileges can achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an in-sandbox overlay f...

CVE-2026-33272

The Red Lion Controls N-Tron 700 Series switch is vulnerable to an authentication bypass via an alternate path or channel (CWE-288 ). A malicious user with physical access to the device can boot the switch from factory settings without authentication. Once booted, the attacker can use default adm...

CVE-2026-39453

The Red Lion Controls N-Tron 700 Series switch is vulnerable to a Reachable Assertion (CWE-617) flaw. Navigating to a specific URL on the device's web server triggers an automatic reboot. An attacker can automate this action using tools like curl to create a persistent Denial of Service (DoS) con...

CVE-2026-29797

The Red Lion Controls N-Tron 700 Series is vulnerable to a Download of Code Without Integrity Check (CWE-494). The root cause is a lack of authentication requirements when updating the firmware or bootloader , which allows attackers to push malicious files to the device. Furthermore, individuals ...

CVE-2026-33367

The Red Lion Controls N-Tron 700 Series is vulnerable to a missing authentication flaw where SNMP can be used to perform administrative actions. Attackers can retrieve configuration files, modify user accounts or device settings, and initiate firmware or bootloader upgrades/downgrades without any...

CVE-2026-28745

The Red Lion Controls N-Tron 700 Series is vulnerable to insecure credential storage. Specifically, usernames and passwords—including default credentials —are saved in the configuration file using weak encryption . A malicious actor who knows the default credentials could potentially recover othe...

CVE-2026-108109

PHPNuxBill versions through 2025.3.20 are vulnerable to an account takeover due to a flaw in the customer password reset flow within system/controllers/forgot.php. The vulnerability allows unauthenticated attackers who know a customer's username to brute-force a 6-digit otp_code because the syste...

CVE-2026-108108

PHPNuxBill versions up to 2025.3.20 are vulnerable to an authentication bypass in RADIUS CHAP verification. The root cause is located in the Password::chap_verify() function, which incorrectly returns true even when the supplied response does not match the expected value. This allows an attacker ...