CVEs published May 25, 2026
187 CVEs were published on May 25, 2026: 19 critical, 58 high.
- Published
- 187
- Critical
- 19
- High
- 58
- Medium
- 103
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 49
Most affected products
- Totolink A8000RU
- 15
- Edimax EW-7438RPn
- 13
- benoitc hackney
- 10
- code-projects Employee Management System
- 9
- Roundcube Webmail
- 8
- GNU LibreDWG
- 5
- Totolink CA750-PoE
- 5
- yashpokharna2555 StudentManagementSystem
- 5
- Edimax BR-6478AC
- 4
- SourceCodester Indian Invoicing System
- 4
Critical 19
- CVE-2026-42773WordPress eMagicOne Store Manager plugin <= 1.3.2 - SQL Injection vulnerabilityeMagicOne Store Manager
- CVE-2026-42774WordPress JetEngine plugin <= 3.8.8.1 - SQL Injection vulnerabilityCrocoblock JetEngine
- CVE-2026-9478Totolink A8000RU Web Management cstecgi.cgi setParentalRules os command injectionTotolink A8000RU
- CVE-2026-9477Totolink A8000RU Web Management cstecgi.cgi setAccessDeviceCfg os command injectionTotolink A8000RU
- CVE-2026-9476Totolink A8000RU Web Management cstecgi.cgi setPasswordCfg os command injectionTotolink A8000RU
- CVE-2026-9475Totolink A8000RU Web Management cstecgi.cgi setIpQosRules os command injectionTotolink A8000RU
- CVE-2026-9058Improper Certificate Verification in Szafir SDKKrajowa Izba Rozliczeniowa Szafir SDK
- CVE-2026-9458Totolink A8000RU Web Management cstecgi.cgi setWanCfg os command injectionTotolink A8000RU
- CVE-2026-9457Totolink A8000RU Web Management cstecgi.cgi UploadFirmwareFile os command injectionTotolink A8000RU
- CVE-2026-9456Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCfg os command injectionTotolink A8000RU
- CVE-2026-9455Totolink A8000RU Web Management cstecgi.cgi UploadOpenVpnCert os command injectionTotolink A8000RU
- CVE-2026-9454Totolink A8000RU Web Management cstecgi.cgi setOpenVpnCertGenerationCfg os command injectionTotolink A8000RU
- CVE-2026-9436Totolink A8000RU Web Management cstecgi.cgi setL2tpServerCfg os command injectionTotolink A8000RU
- CVE-2026-9435Totolink A8000RU Web Management cstecgi.cgi setQosCfg os command injectionTotolink A8000RU
- CVE-2026-9434Totolink A8000RU Web Management cstecgi.cgi setWiFiWpsCfg os command injectionTotolink A8000RU
- CVE-2026-9433Totolink A8000RU Web Management cstecgi.cgi setMacFilterRules os command injectionTotolink A8000RU
- CVE-2026-2651Missing Authorization Validation in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2026-9432Totolink A8000RU Web Management cstecgi.cgi setWiFiAdvancedCfg os command injectionTotolink A8000RU
- CVE-2026-9408Totolink A8000RU Web Management cstecgi.cgi setStaticDhcpRules os command injectionTotolink A8000RU
High 58
- CVE-2026-8376Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit buildsperl
- CVE-2026-45209WordPress MyCryptoCheckout plugin <= 2.161 - Broken Access Control vulnerabilityedward_plainview MyCryptoCheckout
- CVE-2026-45216WordPress Smart Manager plugin <= 8.85.0 - Privilege Escalation vulnerabilityStoreApps Smart Manager
- CVE-2026-45438WordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerabilityWebToffee Smart Coupons for WooCommerce
- CVE-2026-39436WordPress CformsII plugin <= 15.1.3 - Cross Site Request Forgery (CSRF) vulnerabilitybgermann CformsII
- CVE-2026-24937WordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerabilityVideoWhisper.com Broadcast Live Video
- CVE-2026-48837WordPress Unlimited Elements For Elementor plugin <= 2.0.8 - SQL Injection vulnerabilityUnlimited Elements For Elementor
- CVE-2026-48848Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSSRoundcube Webmail
- CVE-2026-48844Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could leaRoundcube Webmail
- CVE-2026-48843Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML Roundcube Webmail
- CVE-2026-48842Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_reRoundcube Webmail
- CVE-2026-9482Edimax EW-7438RPn formSDHCP stack-based overflowEdimax EW-7438RPn
- CVE-2026-9481Edimax EW-7438RPn formStats stack-based overflowEdimax EW-7438RPn
- CVE-2026-9480Edimax EW-7438RPn formrefresh stack-based overflowEdimax EW-7438RPn
- CVE-2026-9479Edimax EW-7438RPn formLogout stack-based overflowEdimax EW-7438RPn
- CVE-2026-42782Apache Syncope: Post-auth RCE via Groovy staticApache Software Foundation Apache Syncope · org.apache.sync…
- CVE-2018-25381Joomla Responsive Portfolio 1.6.1 SQL Injection via filter parametersExtro Responsive Portfolio
- CVE-2018-25380Joomla Component eXtroForms 2.1.5 SQL Injection via filter parameterseXtroForms
- CVE-2018-25379Collectric CMU 1.0 SQL Injection via lang ParameterOurenergy Collectric CMU
- CVE-2018-25377Flash Slideshow Maker Professional 5.20 Buffer Overflow SEHSocuSoft Flash Slideshow Maker Professional
- CVE-2018-25376Socusoft 3GP Photo Slideshow 8.05 Buffer Overflow SEHSocuSoft 3GP Photo Slideshow
- CVE-2018-25375SocuSoft iPod Photo Slideshow 8.05 Buffer Overflow SEHSocuSoft iPod Photo Slideshow
- CVE-2018-25374Softneta MedDream PACS Server Premium 6.7.1.1 Directory TraversalSoftneta MedDream PACS Server Premium
- CVE-2018-25373DVD Photo Slideshow Professional 8.07 Buffer Overflow SEHSocuSoft DVD Photo Slideshow Professional
- CVE-2018-25372MedDream PACS Server Premium 6.7.1.1 SQL Injection via emailMedDream PACS Server Premium
- CVE-2018-25371mooSocial Store Plugin 2.6 SQL Injection via product parametermooSocial Store Plugin
- CVE-2018-25368Nord VPN 6.14.31 Denial of Service via Password FieldNordVPN
- CVE-2018-25366CuteFTP 5.0 XP Buffer Overflow via Site Manager Label Fieldglobalscape CuteFTP
- CVE-2018-25365PCViewer vt1000 Directory Traversal via GET RequestPCViewer
- CVE-2018-25364Twitter-Clone 1 SQL Injection via search.phpFyffe PHP-Twitter-Clone
- CVE-2018-25362Twitter-Clone 1 SQL Injection via follow.phpFyffe PHP-Twitter-Clone
- CVE-2018-25361Soroush IM Desktop App 0.17.0 Authentication Bypass via Database InjectionSoroush IM Desktop App
- CVE-2018-25360AgataSoft Auto PingMaster 1.5 Buffer Overflow SEHAgatasoft Auto PingMaster
- CVE-2018-25359Splinterware System Scheduler Pro 5.12 Privilege EscalationSplinterware System Scheduler Pro
- CVE-2026-47073Unbounded memory consumption in WebSocket client in hackneybenoitc hackney
- CVE-2026-47067Atom table exhaustion via unrecognized URL schemes in hackneybenoitc hackney
- CVE-2026-47077Unbounded body accumulation in HTTP/3 response loop in hackneybenoitc hackney
- CVE-2026-47071SOCKS5 TLS upgrade ignores caller timeout in hackneybenoitc hackney
- CVE-2026-47066Infinite loop in Alt-Svc header parser in hackneybenoitc hackney
- CVE-2026-9463Edimax EW-7438RPn formLicence stack-based overflowEdimax EW-7438RPn
- CVE-2026-9462Edimax EW-7438RPn formWpsProxyEnable stack-based overflowEdimax EW-7438RPn
- CVE-2026-9461Edimax EW-7438RPn formRadius stack-based overflowEdimax EW-7438RPn
- CVE-2026-9460Edimax EW-7438RPn formAccept stack-based overflowEdimax EW-7438RPn
- CVE-2026-9459Edimax EW-7438RPn formConnectionSetting stack-based overflowEdimax EW-7438RPn
- CVE-2026-7766Path Traversal in Kenik camerasKenik KG-5230TAS-IL-3 · Kenik KG-5230TAS-IL-G3 +6
- CVE-2026-45361Apache Airflow Google provider: SSH host key verification disabled in ComputeEngineSSHHook (paramiko AutoAddPolicy default)Apache Software Foundation Apache Airflow Google provider ·…
- CVE-2026-9443Edimax BR-6478AC POST Request formL2TPSetup buffer overflowEdimax BR-6478AC
- CVE-2026-9442Edimax BR-6478AC POST Request formiNICSiteSurvey buffer overflowEdimax BR-6478AC
- CVE-2026-9431Tenda F1202 PptpUserAdd fromPptpUserAdd stack-based overflowTenda F1202
- CVE-2026-9430Tenda F1202 GstDhcpSetSerof formGstDhcpSetSer stack-based overflowTenda F1202
- CVE-2026-25193Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentiaGallagher Command Centre Server · Gallagher Active Dire… +12
- CVE-2026-9429Tenda F1202 WrlExtraSet formWrlExtraSet stack-based overflowTenda F1202
- CVE-2026-9428Tenda F1202 PPTPUserSetting fromPPTPUserSetting stack-based overflowTenda F1202
- CVE-2026-9427Edimax EW-7438RPn webs formWlSiteSurvey stack-based overflowEdimax EW-7438RPn
- CVE-2026-9426Edimax EW-7438RPn formHwSet stack-based overflowEdimax EW-7438RPn
- CVE-2026-9425Edimax EW-7438RPn formWlanMP stack-based overflowEdimax EW-7438RPn
- CVE-2026-8652An OS Command Injection vulnerability exists in Aterm.NEC Platforms Aterm MR51FN · NEC Platforms Aterm CM51FD
- CVE-2026-9489NitroSense V3: Local Privilege Escalation (LPE) vulnerabilityAcer NitrorSense
Medium, low and unrated 110
- CVE-2026-9515Totolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injectionTotolink CA750-PoE
- CVE-2026-9514Totolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injectionTotolink CA750-PoE
- CVE-2026-32389WordPress NanoCare theme < 1.2.2 - Broken Access Control vulnerabilityLinethemes NanoCare
- CVE-2026-42763WordPress SePay Gateway plugin <= 1.1.20 - Sensitive Data Exposure vulnerabilitySePay team SePay Gateway
- CVE-2026-42776WordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerabilityWP Sunshine Sunshine Photo Cart
- CVE-2026-9513Totolink CA750-PoE Setting cstecgi.cgi NTPSyncWithHost os command injectionTotolink CA750-PoE
- CVE-2026-45217WordPress Stripe Payment Gateway for WooCommerce plugin <= 5.0.7 - Broken Authentication vulnerabilityThemeHigh Stripe Payment Gateway for WooCommerce
- CVE-2026-45435WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerabilityMelapress WP Activity Log
- CVE-2026-9512Totolink CA750-PoE Setting cstecgi.cgi setPasswordCfg os command injectionTotolink CA750-PoE
- CVE-2026-9511Totolink CA750-PoE Setting cstecgi.cgi setWebWlanIdx os command injectionTotolink CA750-PoE
- CVE-2026-27357WordPress WP Search Analytics plugin < 1.5.0 - Broken Access Control vulnerabilityCornel Raiu WP Search Analytics
- CVE-2026-27398WordPress RSVP and Event Management plugin <= 2.7.16 - Broken Access Control vulnerabilityWP Chill RSVP and Event Management
- CVE-2026-27346WordPress B2BKing plugin < 5.2.10 - Broken Access Control vulnerabilityKings Plugins B2BKing
- CVE-2026-24554WordPress WPSubscription plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerabilityConvers Lab WPSubscription
- CVE-2026-24527WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.14.0 - Broken Access Control vulnerabilityPatterns in the cloud Autoship Cloud for WooCommerce Subscr…
- CVE-2025-62745WordPress Team Showcase plugin <= 1.22.28 - Cross Site Scripting (XSS) vulnerabilityPickPlugins Team Showcase
- CVE-2026-24586WordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerabilityThemeansar Newses
- CVE-2026-24592WordPress Auto Affiliate Links plugin <= 6.8.8.3 - Broken Access Control vulnerabilityLucian Apostol Auto Affiliate Links
- CVE-2026-9504GNU LibreDWG Dwggrep Utility dwggrep.c bit_convert_TU out-of-boundsGNU LibreDWG
- CVE-2026-24582WordPress FlexTable plugin <= 3.24.0 - Broken Access Control vulnerabilityWPPOOL FlexTable
- CVE-2026-24545WordPress QR Redirector plugin <= 2.0.3 - Broken Access Control vulnerabilityNikki Blight QR Redirector
- CVE-2026-24574WordPress Export WP Page to Static HTML/CSS plugin <= 6.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityRecorp Export WP Page to Static HTML/CSS
- CVE-2026-24597WordPress Organization chart plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerabilityWpDevArt Organization chart
- CVE-2026-9503GNU LibreDWG DWG File decode.c dwg_next_entity null pointer dereferenceGNU LibreDWG
- CVE-2026-9502GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section heap-based overflowGNU LibreDWG
- CVE-2026-9501GNU LibreDWG Dwgread Utility decode.c decompress_R2004_section assertionGNU LibreDWG
- CVE-2026-48589Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flowApache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2026-44598Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)Apache Software Foundation Apache Shiro Jakarta EE module ·…
- CVE-2026-43828Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by defaultApache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2026-48852PuTTY 0.71 before 0.84 has an assertion failure in ECDSA signature verification.PuTTY
- CVE-2026-43827Apache Shiro: Session fixation: new session is not created after login by defaultApache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2026-48851PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a trust indication for TELNET data but the trust status is not cleared between proxyPuTTY
- CVE-2026-9500GNU LibreDWG Dwgread Utility decode.c read_2004_compressed_section heap-based overflowGNU LibreDWG
- CVE-2026-48850PuTTY 0.72 before 0.84 has a double free in RSA KEX.PuTTY
- CVE-2026-9498Dromara lamp-cloud Message Template GroovyClassLoader.parseClass special elements used in a template engineDromara lamp-cloud
- CVE-2026-9497changmingxie tcc-transaction Fastjson AutoType REST API Fastjson.parseObject deserializationchangmingxie tcc-transaction · org.mengyun:tcc-transaction
- CVE-2026-48849In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to storRoundcube Webmail
- CVE-2026-9486SourceCodester Student Grades Management System cross-site request forgerySourceCodester Student Grades Management System
- CVE-2026-24546WordPress GamiPress plugin <= 7.6.3 - Broken Access Control vulnerabilityRuben Garcia GamiPress
- CVE-2026-48847Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session pRoundcube Webmail
- CVE-2026-48846In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() vRoundcube Webmail
- CVE-2026-48845In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to locaRoundcube Webmail
- CVE-2026-9485SourceCodester Student Grades Management System students.php cross site scriptingSourceCodester Student Grades Management System
- CVE-2026-9484SourceCodester Student Grades Management System classroom.php removeStudentFromClassroom improper authorizationSourceCodester Student Grades Management System
- CVE-2026-9483SourceCodester Student Grades Management System grades.php improper authorizationSourceCodester Student Grades Management System
- CVE-2026-9474yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injectionyashpokharna2555 StudentManagementSystem
- CVE-2026-9473c-rick jimeng-mcp api.ts generateVideo path traversalc-rick jimeng-mcp
- CVE-2026-9472dazeb markdown-downloader index.ts create_subdirectory path traversaldazeb markdown-downloader
- CVE-2026-9471yashpokharna2555 StudentManagementSystem student.php cross site scriptingyashpokharna2555 StudentManagementSystem
- CVE-2026-27768SQL Injection affecting the Access Manager role.Genetec Security Center
- CVE-2026-9470yashpokharna2555 StudentManagementSystem student_trans.php confirm_logged_in sql injectionyashpokharna2555 StudentManagementSystem
- CVE-2026-9469yashpokharna2555 StudentManagementSystem success.php sql injectionyashpokharna2555 StudentManagementSystem
- CVE-2026-42797Apache Syncope: JexlContextBuilder Information DisclosureApache Software Foundation Apache Syncope · org.apache.sync…
- CVE-2026-9468dazeb cline-mcp-memory-bank index.ts handleInitializeMemoryBank path traversaldazeb cline-mcp-memory-bank
- CVE-2026-9467debugmcp mcp-debugger server.ts handleGetSourceContext path traversaldebugmcp mcp-debugger
- CVE-2026-9466Tiandy Easy7 Integrated Management Platform API Endpoint updateUserPassword password recoveryTiandy Easy7 Integrated Management Platform
- CVE-2026-9465Tiandy Easy7 Integrated Management Platform GetDBDataEx.jsp sql injectionTiandy Easy7 Integrated Management Platform
- CVE-2018-25378Notebook Pro 2.0 Denial of Service via Notebook Name FieldStokedonit Notebook Pro
- CVE-2018-25370Admidio 3.3.5 Cross-Site Request Forgery via roles_function.phpAdmidio
- CVE-2018-25369Visual Ping 0.8.0.0 Buffer Overflow Denial of Servicescanwith Visual Ping
- CVE-2018-25367NASA openVSP 3.16.1 Denial of Service via Buffer OverflowNASA openVSP
- CVE-2018-25363Twitter-Clone 1 Cross-Site Request Forgery via tweetdel.phpFyffe PHP-Twitter-Clone
- CVE-2026-9078Firefox iOS RTL Domain Rendering Issue in Link PreviewMozilla Firefox for iOS
- CVE-2026-47072CRLF injection in WebSocket upgrade request in hackneybenoitc hackney
- CVE-2026-47076SSRF allowlist bypass via percent-encoded host in hackneybenoitc hackney
- CVE-2026-47070HTTP/3 redirect handler leaks Authorization and Cookie headers to cross-origin redirect target in hackneybenoitc hackney
- CVE-2026-47075CR/LF injection in query parameter in hackneybenoitc hackney
- CVE-2026-47069CRLF injection in cookie domain/path options in hackneybenoitc hackney
- CVE-2026-9464YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgeryYunaiV yudao-cloud
- CVE-2026-9453FoundDream miniclawd SkillsLoader skills-loader.ts which command injectionFoundDream miniclawd
- CVE-2026-9452FoundDream miniclawd exec.ts ExecTool.execute os command injectionFoundDream miniclawd
- CVE-2026-9451code-projects Employee Management System applyleaveprocess.php sql injectioncode-projects Employee Management System
- CVE-2026-46745Apache Airflow FAB provider: LDAP Filter Injection in FAB Auth Manager _search_ldap reachable via /auth/tokenApache Software Foundation Apache Airflow FAB provider · ap…
- CVE-2026-9450code-projects Employee Management System psubmit.php sql injectioncode-projects Employee Management System
- CVE-2026-40127Authorization Bypass Through User-Controlled Key in OutSystems LifetimeOutSystems Lifetime
- CVE-2026-9449code-projects Employee Management System changepassemp.php sql injectioncode-projects Employee Management System
- CVE-2026-9448code-projects Employee Management System applyleave.php cross site scriptingcode-projects Employee Management System
- CVE-2026-9447SourceCodester Simple POS and Inventory System search.php sql injectionSourceCodester Simple POS and Inventory System
- CVE-2026-9446SourceCodester Simple POS and Inventory System edit_customer.php sql injectionSourceCodester Simple POS and Inventory System
- CVE-2026-9274Information Exposure Vulnerability in CP-Plus Wi-Fi CameraCP Plus Wi-Fi Camera CP-E38Q, CP-E48Q, CP-E25Q, CP-E35Q, CP…
- CVE-2026-9445SourceCodester Simple POS and Inventory System File Extension addproduct.php unrestricted uploadSourceCodester Simple POS and Inventory System
- CVE-2026-9444SourceCodester Simple POS and Inventory System GET Parameter deleteproduct.php delete sql injectionSourceCodester Simple POS and Inventory System
- CVE-2026-5223Crates in third party registries can override the cached source of other cratesRust Project Cargo · cargo
- CVE-2026-5222Cargo can be coerced to share credentials between registriesRust Cargo · cargo
- CVE-2026-9441Edimax BR-6478AC POST Request formiNICbasic command injectionEdimax BR-6478AC
- CVE-2026-9440Edimax BR-6478AC POST Request formAccept command injectionEdimax BR-6478AC
- CVE-2026-9439Edimax BR-6675nD stainfo command injectionEdimax BR-6675nD
- CVE-2026-45249Apache ECharts: XSS in Lines series tooltip renderingApache Software Foundation Apache ECharts · echarts
- CVE-2026-9438yashpokharna2555 StudentManagementSystem courseDel.php resource injectionyashpokharna2555 StudentManagementSystem
- CVE-2026-9490Acer Care Center creates a Named Pipe with a weak Security DescriptorAcer Care Center
- CVE-2026-9437DTStack Taier REST API Runtime.exec os command injectionDTStack Taier
- CVE-2026-4915Server panic via outgoing webhook responsesMattermost · github.com/mattermost/mattermost-server +3
- CVE-2026-41863LLM-influenced filename used unsanitized in Path.resolve before file write in Spring AI support for Anthropic Skills APISpring AI · org.springframework.ai:spring-ai-anthropic
- CVE-2026-9424Edimax EW-7438RPn Content-Type formWlanMP os command injectionEdimax EW-7438RPn
- CVE-2026-9423Edimax BR-6675nD POST Request mp command injectionEdimax BR-6675nD
- CVE-2026-9422KLiK SocialMediaWebsite HTTP POST Request Parameter injectionKLiK SocialMediaWebsite
- CVE-2026-9421KLiK SocialMediaWebsite File upload.inc.php uniqid unrestricted uploadKLiK SocialMediaWebsite
- CVE-2026-9420KLiK SocialMediaWebsite HTTP GET Request Parameter injectionKLiK SocialMediaWebsite
- CVE-2026-9419code-projects Employee Management System empproject.php cross site scriptingcode-projects Employee Management System
- CVE-2026-9418code-projects Employee Management System changepassemp.php cross site scriptingcode-projects Employee Management System
- CVE-2026-6059A cross-site scripting vulnerability exists in Aterm.NEC Platforms Aterm WX1800HP · NEC Platforms Aterm WX540… +7
- CVE-2026-9417code-projects Employee Management System myprofileup.php cross site scriptingcode-projects Employee Management System
- CVE-2026-9416code-projects Employee Management System myprofile.php cross site scriptingcode-projects Employee Management System
- CVE-2026-9415code-projects Employee Management System eloginwel.php cross site scriptingcode-projects Employee Management System
- CVE-2026-9414SourceCodester Indian Invoicing System Invoice Template Render Database-Backed add_order.php cross site scriptingSourceCodester Indian Invoicing System
- CVE-2026-9413SourceCodester Indian Invoicing System category.php cross site scriptingSourceCodester Indian Invoicing System
- CVE-2026-9412SourceCodester Indian Invoicing System Backend Endpoint access controlSourceCodester Indian Invoicing System
- CVE-2026-9411SourceCodester Indian Invoicing System Invoice Generation IGST_Invoice.php sql injectionSourceCodester Indian Invoicing System
- CVE-2026-9410Sushmi-pal Invoice-System Profile Workflow profile improper authorizationSushmi-pal Invoice-System
- CVE-2026-9409Sushmi-pal Invoice-System User Management user improper authorizationSushmi-pal Invoice-System