Tue, Sep 09 · 02:15 PM CDTCVE-2025-54236
9.1/10 · Must read/watchNVDvuln
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue doe
CVECVE-2025-54236
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 09 · 02:15 PM CDT
ModifiedTue, Apr 14 · 07:00 PM CDT
CVE-2026-6560
8.8/10 · Worth your timeNVDvuln
Summary
A security vulnerability has been detected in H3C Magic B0 up to 100R002. This vulnerability affects the function Edit_BasicSSID of the file /goform/aspForm. Such manipulation of the argument param leads to buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Th
CVECVE-2026-6560
SeverityHIGH
TypeNEW
PublishedSun, Apr 19 · 07:16 AM CDT
ModifiedSun, Apr 19 · 07:16 AM CDT
CVE-2026-6563
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoById of the file /goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be
CVECVE-2026-6563
SeverityHIGH
TypeNEW
PublishedSun, Apr 19 · 09:16 AM CDT
ModifiedSun, Apr 19 · 09:16 AM CDT
CVE-2026-41113
8.1/10 · Worth your timeNVDvuln
Summary
sagredo qmail before 2026.04.07 allows tls_quit remote code execution because of popen in notlshosts_auto in qmail-remote.c.
CVECVE-2026-41113
SeverityHIGH
TypeUPDATED
PublishedThu, Apr 16 · 10:16 PM CDT
ModifiedSat, Apr 18 · 09:16 PM CDT
CVE-2026-6562
7.3/10 · Worth your timeNVDvuln
Summary
A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is the function getListByPage of the file /index/Search/index.html. Executing a manipulation of the argument keyword can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used. The vendor was conta
CVECVE-2026-6562
SeverityHIGH
TypeNEW
PublishedSun, Apr 19 · 09:16 AM CDT
ModifiedSun, Apr 19 · 09:16 AM CDT
CVE-2026-6568
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareOld of the file /app/controller/share.class.php of the component Public Share Handler. This manipulation of the argument path causes path traversal. The attack can be initiated remotely. The exploit ha
CVECVE-2026-6568
SeverityHIGH
TypeNEW
PublishedSun, Apr 19 · 10:16 AM CDT
ModifiedSun, Apr 19 · 10:16 AM CDT
CVE-2025-1686
6.8/10 · Skim only if relevantNVDvuln
Summary
Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high privileged attacker can access sensitive local files by crafting malicious notification templates that leverage this tag to include files like /etc/passwd or /pro
CVECVE-2025-1686
SeverityMEDIUM
TypeUPDATED
PublishedThu, Feb 27 · 05:15 AM CST
ModifiedSun, Apr 19 · 08:16 AM CDT
CVE-2026-33691
6.8/10 · Skim only if relevantNVDvuln
Summary
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.9 and 4.25.0, a bypass was identified in OWASP CRS that allows uploading files with dangerous extensions (.php, .phar, .jsp, .jspx) by inserting whitespace padding in the fil
CVECVE-2026-33691
SeverityMEDIUM
TypeUPDATED
PublishedThu, Apr 02 · 04:16 PM CDT
ModifiedSat, Apr 18 · 08:16 PM CDT
CVE-2026-0868
6.4/10 · Skim only if relevantNVDvuln
Summary
The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's calendly shortcode in all versions up to, and including, 4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authentic
CVECVE-2026-0868
SeverityMEDIUM
TypeNEW
PublishedSun, Apr 19 · 04:16 AM CDT
ModifiedSun, Apr 19 · 04:16 AM CDT
CVE-2026-2986
6.4/10 · Skim only if relevantNVDvuln
Summary
The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and ab
CVECVE-2026-2986
SeverityMEDIUM
TypeNEW
PublishedSat, Apr 18 · 12:16 PM CDT
ModifiedSat, Apr 18 · 12:16 PM CDT
CVE-2025-40909
5.9/10 · Skim only if relevantNVDvuln
Summary
Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread a
CVECVE-2025-40909
SeverityMEDIUM
TypeUPDATED
PublishedFri, May 30 · 01:15 PM CDT
ModifiedSat, Apr 18 · 03:16 PM CDT
CVE-2026-6561
4.7/10 · SkipNVDvuln
Summary
A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function edit_adminlogo of the file application/admin/controller/Index.php. Performing a manipulation of the argument filename results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may
CVECVE-2026-6561
SeverityMEDIUM
TypeNEW
PublishedSun, Apr 19 · 08:16 AM CDT
ModifiedSun, Apr 19 · 08:16 AM CDT
CVE-2026-6559
4.3/10 · SkipNVDvuln
Summary
A weakness has been identified in Wavlink WL-WN579A3 220323. This affects the function sub_401F80 of the file /cgi-bin/login.cgi. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. Upgrading the affected component is recommended. The vendor was contact
CVECVE-2026-6559
SeverityMEDIUM
TypeNEW
PublishedSun, Apr 19 · 06:16 AM CDT
ModifiedSun, Apr 19 · 06:16 AM CDT
CVE-2026-6564
4.3/10 · SkipNVDvuln
Summary
A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the component Session Handling. The manipulation results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted earl
CVECVE-2026-6564
SeverityMEDIUM
TypeNEW
PublishedSun, Apr 19 · 10:16 AM CDT
ModifiedSun, Apr 19 · 10:16 AM CDT
CVE-2026-40948
4.8/10 · SkipNVDvuln
Summary
The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the
CVECVE-2026-40948
SeverityUNKNOWN
TypeNEW
PublishedSat, Apr 18 · 02:16 PM CDT
ModifiedSat, Apr 18 · 02:16 PM CDT
CVE-2026-41242
4.8/10 · SkipNVDvuln
Summary
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue.
CVECVE-2026-41242
SeverityUNKNOWN
TypeNEW
PublishedSat, Apr 18 · 05:16 PM CDT
ModifiedSat, Apr 18 · 05:16 PM CDT
CVE-2026-6056
4.8/10 · SkipNVDvuln
Summary
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVECVE-2026-6056
SeverityUNKNOWN
TypeNEW
PublishedSat, Apr 18 · 11:16 PM CDT
ModifiedSat, Apr 18 · 11:16 PM CDT
