Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
644 results · Clear filters · Feed
-
Critical 10.0
D-Link DIR-600L HNAP cgibin hnap_main stack-based overflow
A flaw has been found in D-Link DIR-600L 2.17b02. Affected by this issue is the function hnap_main of the file htdocs/cgibin of the component HNAP Handler. Executing a manipulation can lead to stack-based buffer overflow. The attack can be executed remotely. …
-
Critical 10.0
D-Link DIR-600L authentication.cgi authenticationcgi_main stack-based overflow
A vulnerability was detected in D-Link DIR-600L 2.17/2.17b02. Affected by this vulnerability is the function authenticationcgi_main of the file authentication.cgi. Performing a manipulation of the argument id/password results in stack-based buffer overflow. R…
-
Critical 9.1
TRENDnet TEW-657BRM upgrade_flash.cgi stack-based overflow
A vulnerability was detected in TRENDnet TEW-657BRM 1.00.1. This issue affects some unknown processing of the file /usr/sbin/upgrade_flash.cgi. Performing a manipulation of the argument boundary results in stack-based buffer overflow. The attack is possible t…
-
Critical 10.0
A security vulnerability has been detected in TRENDnet TEW-657BRM 1.00.1. This vulnerability affects the function sprin…
-
Critical 9.4
A vulnerability was identified in Tenda AC18 15.03.05.05_multi/15.03.05.19 Build 6318. Affected by this vulnerability i…
-
Critical 9.8
The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the…
-
Critical 9.8
The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is vulner…
-
Critical 9.4
Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows authen…
-
Critical 9.3
A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.6. This affects the function sub_11504 in the library Wi…
-
Critical 9.4
A security vulnerability has been detected in Edimax BR6478ACV2 1.23. The impacted element is the function formPPTPSetu…
-
Critical 9.8CVE-2026-126173 Public exploit
The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, an…
-
Critical 9.8
VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx
VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no au…
-
Critical 9.1
Tactical RMM 0.17.0 through 1.6.1 Arbitrary File Read via Report Preview
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permi…
-
Critical 9.2
Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability t…
-
Critical 9.3
NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to …
-
Critical 9.3
A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free accou…
-
Critical 9.2
C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell com…
-
Critical 9.2
C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell…
-
Critical 9.2
C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious pe…
-
Critical 9.4
OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning
OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a…
-
Critical 9.3
Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container
The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesyst…
-
Critical 9.8CVE-2026-129110 Public exploit
sysPass 3.0.1 through 3.2.11 Unauthenticated Reinstallation RCE via install/install
sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite …
-
Critical 9.1
Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could pot…
-
Critical 9.3
RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vu…
-
Critical 9.3
WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.
-
Critical 9.3
WordPress WP BASE Booking plugin <= 6.5.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6…
-
Critical 9.9
WordPress Hotel Booking Lite theme <= 2.5.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite allows Upload a Web Shell to a Web Server.This issue affects Hotel Booking Lite: from n/a through 2.5.1.
-
Critical 9.8CVE-2026-125855 Public exploit
WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: fr…
-
Critical 9.8
PLANET GS-5220-8P2T2S Stack Buffer Overflow via webstax_auth Cookie
PLANET GS-5220-8P2T2S (hardware version 3.0) firmware versions before 3.2412b261008 contains a stack-based buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by submitting an oversized webstax_auth HTTP Cookie value th…
-
Critical 9.2
Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so th…
-
Critical 9.2
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to …
-
Critical 9.1
SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, a…
-
Critical 9.3CVE-2026-126269 Public exploit
NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to …
-
Critical 9.2CVE-2026-126273 Public exploit
NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-…
-
Critical 9.1
NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens becau…
-
Critical 9.8
Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure
Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, c…
-
Critical 9.4
Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos…
-
Critical 9.2
Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that u…
-
Critical 9.1
Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload
Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing bi…
-
Critical 9.8CVE-2026-119077 Public exploit
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form s…