Archive
10 March 2026
Vulnerabilities first published on this day (UTC), newest first.
121 results · Clear filters · Feed
-
Medium 6.5
A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer…
-
Medium 6.0
An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDe…
-
Medium 4.6
An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerab…
-
Medium 5.0
An authentication bypass by spoofing vulnerability in Fortinet FortiWeb 7.6.0 through 7.6.3, FortiWeb 7.4.0 through 7.4…
-
Medium 6.7
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet…
-
Medium 5.9
A stack-based buffer overflow vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, For…
-
Medium 5.1
An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated …
-
Medium 6.9
Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.12 and 9.5.1-alpha.1, the requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited ke…
-
Medium 4.3
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application leaks c…
-
Medium 6.7
A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The affected application performs file …
-
Medium 5.1
A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK server component do…
-
Medium 5.1
A vulnerability has been identified in SICAM SIAPP SDK (All versions < V2.1.7). The SICAM SIAPP SDK client component do…
-
Medium 6.5
Same-origin policy bypass in the CSS Parsing and Computation component
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 148.0.2.
-
Medium 4.6
Cross-Site Scripting Vulnerability in SiteMinder Administrative UI
Cross-site Scripting (XSS) allows an attacker to submit specially crafted data to the application which is returned unaltered in the resulting web page.
-
Medium 5.3
Unauthorized session creation via reserved framework path access
An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths. A…
-
Medium 6.1
The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an …
-
Medium 6.4CVE-2026-3228 Public exploit
NextScripts: Social Networks Auto-Poster <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'nxs_fbembed' Shortcode
The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[nxs_fbembed]` shortcode in all versions up to, and including, 4.4.6. This is due to insufficient input sanitization and output escaping on…
-
Medium 5.3CVE-2026-23907 Public exploit
Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code
This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6. The ExtractEmbeddedFiles example contains a path traversal vulnerability (CWE-22) because the filename that is obtained from PDComplexF…
-
Medium 5.8
Local Privilege Escalation Due to Writable Executable in Privileged Visionline Service Path
Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Visionline on Windows allows Configuration/Environment Manipulation.This issue affects Visionline: from…
-
Medium 6.5
Incorrect Permission Assignment on power analyzer
An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result of incorrect permission assignment for the web server.
-
Medium 5.3
Use of a Broken or Risky Cryptographic Algorithm for firmware images of power analyzer
An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.
-
Medium 6.5
Use of Hard-coded Credentials in power analyzer
An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and write privileges.
-
Medium 4.3
Court Reservation < 1.10.9 - Event Deletion via CSRF
The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete them via a CSRF attack
-
Medium 5.9
Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC Series
Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V and M80VW, M800 Series M800W and M800S, M80 Series M80 and M80W, E80 Series E80, C80 Series C80, and…
-
Medium 5.3
Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all vers…
-
Medium 5.3
Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes…
-
Medium 6.1
InfoSphere Data Architect (IDA) 9.2.1 Vulnerability Fixes.
Affected Product(s)Version(s)InfoSphere Data Architect9.2.1
-
Medium 4.4
IBM Planning Analytics Advanced Certified Containers is vulnerable to a sensitive information disclosure vulnerability
IBM Planning Analytics Advanced Certified Containers 3.1.0 through 3.1.4 could allow a local privileged user to obtain sensitive information from environment variables.
-
Medium 5.0
Missing Authorization check in SAP NetWeaver Application Server for ABAP
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute …
-
Medium 5.8
Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal
Due to missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal, a user with high privileges could access sensitive data belonging to another company. This vulnerability has a high impact on confidentiality and does not affect integrit…
-
Medium 5.9
Missing Authorization check in SAP Business Warehouse (Service API)
Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform unauthorized actions via an affected RFC function module. Successful exploitation could enable unauthorized configuration and control changes…
-
Medium 6.4
SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification)
SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacker to inject arbitrary SQL code through user-controlled input fields. The application concatenates these inputs directly into SQL queries wi…
-
Medium 5.0
DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT
SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directories. The malicious co…
-
Medium 6.4
Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP
SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploi…
-
Medium 5.0
Missing Authorization check in SAP Solution Tools Plug-In (ST-PI)
SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing system information to be disclosed. This vulnerability has a low impact on confidentiality and does not af…
-
Medium 5.6
Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0
The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechanisms. Access to this data, combined with user?initiated interaction, may allow modifications to occur…
-
Medium 6.4
Missing Authorization check in SAP NetWeaver Application Server for ABAP
Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system. This unauthorize…
-
Medium 6.1
DOM-based Cross-Site Scripting (XSS) Vulnerability in SAP Business One (Job Service)
Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could allow an unauthenticated attacker to inject specially crafted input which upon user interaction could result in a DOM-based Cross-Site Scri…
-
Medium 6.1
A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8…
-
Medium 6.1
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in benkeen ge…