CVE alerts
60 alerts in this category.
Threat alerts that map to a registered CVE entry. Each carries severity, exploitation status, affected products, and a direct path to the vendor patch.
Critical Vulnerability: CVE-2026-13594
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
CVE-2026-13594Critical Vulnerability: CVE-2026-4052
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System
CVE-2026-4052Critical Vulnerability: CVE-2026-120534
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insuff
CVE-2026-120534Critical Vulnerability: CVE-2026-120518
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation
CVE-2026-120518Critical Vulnerability: CVE-2026-79589
The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure
CVE-2026-79589Critical Vulnerability: CVE-2026-107029
Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.
CVE-2026-107029Critical Vulnerability: CVE-2023-29073 — autodesk — autocad, autocad_advance_steel
A maliciously crafted MODEL file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a cras
autodeskCVE-2023-29073Critical Vulnerability: CVE-2023-29074 — autodesk — autocad, autocad_advance_steel
A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, r
autodeskCVE-2023-29074Critical Vulnerability: CVE-2026-86596
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitizati
CVE-2026-86596Critical Vulnerability: CVE-2026-76407
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that
CVE-2026-76407Critical Vulnerability: CVE-2026-76528
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that
CVE-2026-76528Critical Vulnerability: CVE-2026-119716
pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments
CVE-2026-119716Critical Vulnerability: CVE-2026-102435
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and includ
CVE-2026-102435Critical Vulnerability: CVE-2026-107057
An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.
CVE-2026-107057Critical Vulnerability: CVE-2019-5413 — morgan_project — morgan
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
morgan_projectCVE-2019-5413Critical Vulnerability: CVE-2019-12874 — videolan — vlc_media_player
An issue was discovered in zlib_decompress_extra in modules/demux/mkv/util.cpp in VideoLAN VLC media player 3.x through 3.0.7. The Matroska demuxer, while parsing a malformed MKV file type, has a doub
videolanCVE-2019-12874Critical Vulnerability: CVE-2026-88811
Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7,
CVE-2026-88811Critical Vulnerability: CVE-2026-105769
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. kaniko uses the Azure Container Registry credential help
CVE-2026-105769Critical Vulnerability: CVE-2026-94290
SUSE Rancher Fleet clusters reference a kubeconfig secret that the controller uses to install and manage a Fleet agent on the target cluster. The controller did not sufficiently restrict which kubecon
CVE-2026-94290Critical Vulnerability: CVE-2026-77876
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module that allows attackers to execute arbitrary commands by
CVE-2026-77876Critical Vulnerability: CVE-2026-73696
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginW
CVE-2026-73696Critical Vulnerability: CVE-2026-73695
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an includ
CVE-2026-73695Critical Vulnerability: CVE-2026-73697
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attack
CVE-2026-73697Critical Vulnerability: CVE-2026-120446
madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application.
CVE-2026-120446Critical Vulnerability: CVE-2026-120198
A vulnerability has been found in WAVLINK WL-WN530BE1-A V251117. Affected is the function con_check_read_finish of the file /protocol.csp. Such manipulation of the argument group_name/IP-FROM leads to
CVE-2026-120198Critical Vulnerability: CVE-2026-120442
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. A
CVE-2026-120442Critical Vulnerability: CVE-2026-64618 — apache — fineract
Improper Neutralization of Special Elements used in an SQL Command ("SQL Injection") vulnerability exists in Apache Fineract (through version 1.15.0). The vulnerability affects the outStandingAmountPe
apacheCVE-2026-64618Critical Vulnerability: CVE-2026-120213
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and
CVE-2026-120213Critical Vulnerability: CVE-2025-11969
The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits un
CVE-2025-11969Critical Vulnerability: CVE-2026-120345
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation o
CVE-2026-120345Critical Vulnerability: CVE-2026-120344
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of
CVE-2026-120344Critical Vulnerability: CVE-2026-120322
A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPa
CVE-2026-120322Critical Vulnerability: CVE-2026-120281
A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip result
CVE-2026-120281Critical Vulnerability: CVE-2026-120283
A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-bas
CVE-2026-120283Critical Vulnerability: CVE-2026-120279
A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argumen
CVE-2026-120279Critical Vulnerability: CVE-2026-120282
A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote
CVE-2026-120282Critical Vulnerability: CVE-2026-120280
A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of
CVE-2026-120280Critical Vulnerability: CVE-2026-120277
A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such mani
CVE-2026-120277Critical Vulnerability: CVE-2026-120276
A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulatio
CVE-2026-120276Critical Vulnerability: CVE-2026-120240
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulati
CVE-2026-120240Critical Vulnerability: CVE-2026-120238
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_
CVE-2026-120238Critical Vulnerability: CVE-2026-120239
A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation
CVE-2026-120239Critical Vulnerability: CVE-2026-120338
Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including
CVE-2026-120338Critical Vulnerability: CVE-2026-62048
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a thro
CVE-2026-62048Critical Vulnerability: CVE-2026-120230
A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injecti
CVE-2026-120230Critical Vulnerability: CVE-2026-120231
A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the
CVE-2026-120231Critical Vulnerability: CVE-2026-120229
A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injecti
CVE-2026-120229Critical Vulnerability: CVE-2026-120228
A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_416D88 of the file /bin/ioos of the component ioos Service. Executing a manipulation of the argume
CVE-2026-120228Critical Vulnerability: CVE-2026-120308
A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue. The gateway builds the host path by joining the shared volumes root, the workspace name, and the volume identifie
CVE-2026-120308Critical Vulnerability: CVE-2026-120307
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount d
CVE-2026-120307Critical Vulnerability: CVE-2026-120306
Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on the build worker. The worker image sets BUILDAH_ISOLATION=chroot, and no buildah
CVE-2026-120306Critical Vulnerability: CVE-2026-120227
A vulnerability was detected in WAVLINK WN701AE M01AE_V260105. This affects the function del_staticrule of the file static_route_setting.sh of the component ioos Web Backend. Performing a manipulation
CVE-2026-120227Critical Vulnerability: CVE-2026-120225
A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argume
CVE-2026-120225Critical Vulnerability: CVE-2026-120224
A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1. Affected is the function run_apis_by_json/run_async_task of the component API Authorization. The manipulation results in impr
CVE-2026-120224Critical Vulnerability: CVE-2026-120195
A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d4. The impacted element is the function set_wzdgwMesh of the file /cgi-bin/adm.cgi of the component Initial Setup Wi
CVE-2026-120195Critical Vulnerability: CVE-2026-120196
A vulnerability was detected in WAVLINK WN579X3-D V250402. This affects the function port_forward of the file /cgi-bin/wapi.cgi. The manipulation of the argument Name results in os command injection.
CVE-2026-120196Critical Vulnerability: CVE-2026-120197
A flaw has been found in WAVLINK WL-WN530HG4B M_V260724. This impacts the function port_forward of the file /cgi-bin/wapi.cgi. This manipulation of the argument Name causes os command injection. It is
CVE-2026-120197Critical Vulnerability: CVE-2026-120189
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function save_upload_file/mp_upload_file of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipul
CVE-2026-120189Critical Vulnerability: CVE-2026-118636
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front
CVE-2026-118636Critical Vulnerability: CVE-2026-120209
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the test
CVE-2026-120209
Get alerts that match YOUR environment
This page shows everything in the category. Vulnios narrows it down to alerts that affect your actual asset inventory — only the CVEs you need to act on.
Start a free scan