Sat, May 09 · 08:16 PM CDTCVE-2026-42569
9.4/10 · Must read/watchNVDvuln
Summary
phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.
CVECVE-2026-42569
SeverityCRITICAL
TypeNEW
PublishedSat, May 09 · 08:16 PM CDT
ModifiedSat, May 09 · 08:16 PM CDT
CVE-2025-54236
9.1/10 · Must read/watchNVDvuln
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue doe
CVECVE-2025-54236
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 09 · 02:15 PM CDT
ModifiedTue, May 05 · 01:00 AM CDT
CVE-2026-42605
8.8/10 · Worth your timeNVDvuln
Summary
AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the currentDirectory request parameter in the Flow.js media upload endpoint (POST /api/station/{station_id}/files/upload) is not sanitized for path traversal sequences. When combined with a local filesystem storage backend (the
CVECVE-2026-42605
SeverityHIGH
TypeNEW
PublishedSat, May 09 · 08:16 PM CDT
ModifiedSat, May 09 · 08:16 PM CDT
CVE-2026-8234
8.8/10 · Worth your timeNVDvuln
Summary
A security vulnerability has been detected in EFM ipTIME A8004T 14.18.2. This vulnerability affects the function formWifiBasicSet of the file /goform/WifiBasicSet. The manipulation of the argument security_5g leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publ
CVECVE-2026-8234
SeverityHIGH
TypeNEW
PublishedSun, May 10 · 07:16 AM CDT
ModifiedSun, May 10 · 07:16 AM CDT
CVE-2026-42562
8.3/10 · Worth your timeNVDvuln
Summary
Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/users/{id}. The endpoint directly persists the admin attribute from user input, and the escalated account can immediately ac
CVECVE-2026-42562
SeverityHIGH
TypeNEW
PublishedSat, May 09 · 08:16 PM CDT
ModifiedSat, May 09 · 08:16 PM CDT
CVE-2026-42606
8.1/10 · Worth your timeNVDvuln
Summary
AzuraCast is a self-hosted, all-in-one web radio management suite. Prior to version 0.23.6, the ApplyXForwarded middleware unconditionally trusts the client-supplied X-Forwarded-Host HTTP header with no trusted proxy allowlist. An unauthenticated attacker can poison the password reset URL sent to any user by injecting
CVECVE-2026-42606
SeverityHIGH
TypeNEW
PublishedSat, May 09 · 08:16 PM CDT
ModifiedSat, May 09 · 08:16 PM CDT
CVE-2026-7270
7.8/10 · Worth your timeNVDvuln
Summary
An operator precedence bug in the kernel results in a scenario where a buffer overflow causes attacker-controlled data to overwrite adjacent execve(2) argument buffers. The bug may be exploitable by an unprivileged user to obtain superuser privileges.
CVECVE-2026-7270
SeverityHIGH
TypeUPDATED
PublishedThu, Apr 30 · 07:16 AM CDT
ModifiedSun, May 10 · 08:16 AM CDT
CVE-2026-42574
7.5/10 · Worth your timeNVDvuln
Summary
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same or later archive could t
CVECVE-2026-42574
SeverityHIGH
TypeNEW
PublishedSat, May 09 · 08:16 PM CDT
ModifiedSat, May 09 · 08:16 PM CDT
CVE-2026-42575
7.5/10 · Worth your timeNVDvuln
Summary
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and available via ChecksumString(
CVECVE-2026-42575
SeverityHIGH
TypeNEW
PublishedSat, May 09 · 08:16 PM CDT
ModifiedSat, May 09 · 08:16 PM CDT
CVE-2026-8216
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was identified in Industrial Application Software IAS Canias ERP 8.03. This issue affects the function iasServerRemoteInterface.doAction of the component Java RMI Session Management. Such manipulation leads to improper authentication. The attack can be launched remotely. The vendor was contacted early a
CVECVE-2026-8216
SeverityHIGH
TypeNEW
PublishedSun, May 10 · 01:16 AM CDT
ModifiedSun, May 10 · 01:16 AM CDT
CVE-2026-42576
6.5/10 · Skim only if relevantNVDvuln
Summary
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked
CVECVE-2026-42576
SeverityMEDIUM
TypeNEW
PublishedSat, May 09 · 08:16 PM CDT
ModifiedSat, May 09 · 08:16 PM CDT
CVE-2026-45181
6.5/10 · Skim only if relevantNVDvuln
Summary
Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation (via argument injection), which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file.
CVECVE-2026-45181
SeverityMEDIUM
TypeNEW
PublishedSat, May 09 · 10:16 PM CDT
ModifiedSun, May 10 · 08:16 AM CDT
CVE-2026-45184
6.5/10 · Skim only if relevantNVDvuln
Summary
Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.
CVECVE-2026-45184
SeverityMEDIUM
TypeNEW
PublishedSat, May 09 · 11:16 PM CDT
ModifiedSat, May 09 · 11:16 PM CDT
CVE-2026-8185
6.3/10 · Skim only if relevantNVDvuln
Summary
A security vulnerability has been detected in UGREEN CM933 1.1.59.4319. The impacted element is an unknown function of the component Administrative Interface. Such manipulation leads to missing authentication. The attack requires being on the local network. You should upgrade the affected component. The vendor replied:
CVECVE-2026-8185
SeverityMEDIUM
TypeNEW
PublishedSat, May 09 · 11:16 AM CDT
ModifiedSat, May 09 · 11:16 AM CDT
CVE-2026-8188
6.3/10 · Skim only if relevantNVDvuln
Summary
A vulnerability has been found in Wavlink NU516U1 M16U1_V240425. Affected is the function change_wifi_password of the file /cgi-bin/adm.cgi. The manipulation of the argument wl_channel/wl_Pass/EncrypType leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the
CVECVE-2026-8188
SeverityMEDIUM
TypeNEW
PublishedSat, May 09 · 04:16 PM CDT
ModifiedSat, May 09 · 04:16 PM CDT
CVE-2026-8189
6.3/10 · Skim only if relevantNVDvuln
Summary
A vulnerability was found in Wavlink NU516U1 M16U1_V240425. Affected by this vulnerability is the function wzdrepeater of the file /cgi-bin/adm.cgi. The manipulation of the argument wlan_bssid/sel_Automode/sel_EncrypTyp results in os command injection. It is possible to launch the attack remotely. The exploit has been
CVECVE-2026-8189
SeverityMEDIUM
TypeNEW
PublishedSat, May 09 · 05:16 PM CDT
ModifiedSat, May 09 · 05:16 PM CDT
CVE-2026-8190
6.3/10 · Skim only if relevantNVDvuln
Summary
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. Affected by this issue is the function wan of the file /cgi-bin/adm.cgi. This manipulation of the argument ppp_username/ppp_passwd/rwan_ip/rwan_mask/rwan_gateway is directly passed by the attacker/so we can control the ppp_username/ppp_passwd/rwan_ip/rwan
CVECVE-2026-8190
SeverityMEDIUM
TypeNEW
PublishedSat, May 09 · 06:16 PM CDT
ModifiedSat, May 09 · 06:16 PM CDT
CVE-2026-8191
6.3/10 · Skim only if relevantNVDvuln
Summary
A vulnerability was identified in Wavlink NU516U1 M16U1_V240425. This affects the function wifi_region of the file /cgi-bin/adm.cgi. Such manipulation of the argument skiplist1/skiplist2 leads to os command injection. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor w
CVECVE-2026-8191
SeverityMEDIUM
TypeNEW
PublishedSat, May 09 · 07:16 PM CDT
ModifiedSat, May 09 · 07:16 PM CDT
CVE-2026-8192
6.3/10 · Skim only if relevantNVDvuln
Summary
A security flaw has been discovered in Wavlink NU516U1 M16U1_V240425. This vulnerability affects the function wzdap of the file /cgi-bin/adm.cgi. Performing a manipulation of the argument EncrypType/wl_Pass is directly passed by the attacker/so we can control the EncrypType/wl_Pass results in os command injection. The
CVECVE-2026-8192
SeverityMEDIUM
TypeNEW
PublishedSat, May 09 · 07:16 PM CDT
ModifiedSat, May 09 · 07:16 PM CDT
CVE-2026-8193
6.3/10 · Skim only if relevantNVDvuln
Summary
A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rendering. Executing a manipulation can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public an
CVECVE-2026-8193
SeverityMEDIUM
TypeNEW
PublishedSat, May 09 · 07:16 PM CDT
ModifiedSat, May 09 · 07:16 PM CDT
CVE-2026-8217
6.3/10 · Skim only if relevantNVDvuln
Summary
A security flaw has been discovered in Industrial Application Software IAS Canias ERP 8.03. Impacted is the function Runtime.getRuntime.exec of the component RMI Interface. Performing a manipulation of the argument troiaCode results in os command injection. The attack may be initiated remotely. The exploit has been rel
CVECVE-2026-8217
SeverityMEDIUM
TypeNEW
PublishedSun, May 10 · 02:16 AM CDT
ModifiedSun, May 10 · 02:16 AM CDT
CVE-2026-8227
6.3/10 · Skim only if relevantNVDvuln
Summary
A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipulation causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted
CVECVE-2026-8227
SeverityMEDIUM
TypeNEW
PublishedSun, May 10 · 05:16 AM CDT
ModifiedSun, May 10 · 05:16 AM CDT
CVE-2026-8228
6.3/10 · Skim only if relevantNVDvuln
Summary
A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Such manipulation of the argument wlan_conf/Channel/skiplist/ieee_80211h leads to os command injection. The attack may be launched remotely. The exploit has been disclosed publicly a
CVECVE-2026-8228
SeverityMEDIUM
TypeNEW
PublishedSun, May 10 · 05:16 AM CDT
ModifiedSun, May 10 · 05:16 AM CDT
CVE-2026-8229
6.3/10 · Skim only if relevantNVDvuln
Summary
A vulnerability was detected in Wavlink NU516U1 240425. The affected element is the function WifiBasic of the file /cgi-bin/wireless.cgi. Performing a manipulation of the argument AuthMethod/EncrypType results in os command injection. Remote exploitation of the attack is possible. The exploit is now public and may be u
CVECVE-2026-8229
SeverityMEDIUM
TypeNEW
PublishedSun, May 10 · 05:16 AM CDT
ModifiedSun, May 10 · 05:16 AM CDT
CVE-2026-8230
6.3/10 · Skim only if relevantNVDvuln
Summary
A flaw has been found in Wavlink NU516U1 240425. The impacted element is the function sys_login1 of the file /cgi-bin/login.cgi. Executing a manipulation of the argument ipaddr can lead to os command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted
CVECVE-2026-8230
SeverityMEDIUM
TypeNEW
PublishedSun, May 10 · 05:16 AM CDT
ModifiedSun, May 10 · 05:16 AM CDT
