24h | 7d | 30d

CVE-2026-86554

Overview

  • ZTE
  • SmartLife
20 Sep 2026
Published
21 Sep 2026
Updated
CVSS v3.1
MEDIUM (4.3)
EPSS
0.33%
KEV

Description

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email address is registered for a SmartLife account. If the account exists, the real backend account ID can also be retrieved.

Statistics

  • 1 Post
Last activity: 19 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-86554: SmartLife app leaks runtime auth parameters, letting attackers query /account/verify.serv to confirm registered emails and pull real account IDs. CVSS 4.3, no patch yet. valtersit.com/cve/CVE-2026-865

  • 0
  • 0
  • 0
  • 19h ago

CVE-2026-94111

Overview

  • Tencent
  • BrowserSkill
20 Sep 2026
Published
21 Sep 2026
Updated
CVSS v4.0
MEDIUM (6.9)
EPSS
0.14%
KEV

Description

Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that accepts any chrome-extension origin with 32 characters in range a-p. Attackers can register a malicious extension as a browser client to intercept and manipulate page content, DOM, and screenshots returned to the AI agent.

Statistics

  • 1 Post
Last activity: 3 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-94111: auth bypass in Tencent BrowserSkill to 0.3.0. A crafted chrome-extension origin fools the local daemon WebSocket check, letting attackers hijack page content and screenshots fed to the AI agent. CVSS 6.6, no patch yet. valtersit.com/cve/CVE-2026-941

  • 0
  • 0
  • 0
  • 3h ago

CVE-2026-103882

Overview

  • acadlix
  • Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress
31 Oct 2026
Published
31 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
0.79%
KEV

Description

The Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the post_delete_assessment_file_by_id function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The route's permission callback only verifies a generic wp_rest nonce that the plugin itself emits inside the public acadlixOptions JavaScript object on every frontend page, effectively reducing the authentication requirement to unauthenticated.

Statistics

  • 1 Post
Last activity: 21 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

Acadlix LMS WordPress plugin ≤1.1.9 is affected by CRITICAL CVE-2026-103882: arbitrary file deletion due to weak path validation & nonce checks. Leads to potential RCE. No patch — restrict access/disable plugin. radar.offseq.com/threat/the-ac

  • 0
  • 0
  • 0
  • 21h ago

CVE-2026-93980

Overview

  • code-projects
  • Internship Management System
20 Sep 2026
Published
21 Sep 2026
Updated
CVSS v4.0
MEDIUM (6.9)
EPSS
0.43%
KEV

Description

A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the component Admin Login Form. Executing a manipulation of the argument Password can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Statistics

  • 1 Post
Last activity: 16 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-93980: SQL injection in code-projects Internship Management System 1.0 admin login, CVSS 7.3, public exploit out, no patch known. Restrict admin access and update immediately. #CVE #infosec #cybersecurity valtersit.com/cve/CVE-2026-939

  • 0
  • 0
  • 0
  • 16h ago

CVE-2026-101767

Overview

  • Oracle Corporation
  • Oracle Application Object Library
20 Oct 2026
Published
21 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.61%
KEV

Description

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Statistics

  • 1 Post
Last activity: 13 hours ago

Fediverse

Profile picture fallback
🛡️ #1 hacks.gr @hacksgr

Security researchers and threat monitors report early exploratory probes targeting CVE-2026-101767, a critical 9.8-severity flaw in Oracle E-Business Suite.

The issue involves unauthenticated SQL injection in the Thin Client Framework servlet, enabling remote command execution as the application account.

Oracle patched the vulnerability in its recent update.

en.hacks.gr/prospatheies-ekmet

#Oracle #SQLInjection #Vulnerability #Patch

  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-94112

Overview

  • mayswind
  • ezBookkeeping
20 Sep 2026
Published
21 Sep 2026
Updated
CVSS v4.0
HIGH (7.6)
EPSS
Pending
KEV

Description

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90 seconds without detection.

Statistics

  • 1 Post
Last activity: Last hour

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-94112 ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, letting attackers replay captured codes within the ~90s window. CVSS 6.8. Patch under review - limit exposure and watch for updates. #CVE #infosec valtersit.com/cve/CVE-2026-941

  • 0
  • 0
  • 0
  • Last hour

CVE-2026-94106

Overview

  • james-heinrich
  • getid3
20 Sep 2026
Published
21 Sep 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
1.66%
KEV

Description

getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings. Attackers can craft malicious filenames containing shell metacharacters to inject arbitrary commands executed with the privileges of the process embedding getID3.

Statistics

  • 1 Post
Last activity: 22 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-94106: OS command injection in getID3 before 1.9.26 lets crafted filenames run arbitrary commands. CVSS 8.8. No patch yet - review your exposure and restrict uploads now. #CVE #infosec #cybersecurity valtersit.com/cve/CVE-2026-941

  • 0
  • 0
  • 0
  • 22h ago

CVE-2026-94104

Overview

  • nivocart
  • nivocart
20 Sep 2026
Published
24 Sep 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
0.67%
KEV

Description

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible image/data/ directory and execute them for remote code execution.

Statistics

  • 1 Post
Last activity: 13 hours ago

Fediverse

Profile picture fallback
Hugo | DevOps | Cybersecurity @hugovalters

CVE-2026-94104: NivoCart through 2.4.0 RCE via arbitrary file upload in File Manager multi() endpoint. View-only back-office access is enough to drop PHP and execute it. CVSS 8.8, no patch yet. Restrict access now. #CVE #infosec #cybersecurity valtersit.com/cve/CVE-2026-941

  • 0
  • 0
  • 0
  • 13h ago

CVE-2026-118636

Overview

  • Apache Software Foundation
  • Apache MINA
  • org.apache.mina:mina-core
31 Oct 2026
Published
31 Oct 2026
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

**UNSUPPORTED WHEN ASSIGNED**  JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X branch.

Statistics

  • 1 Post
Last activity: 9 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-118636: CRITICAL RCE in Apache MINA 3.0.0 codec via unsafe deserialization in JavaNativeMessageDecoder. No fix – 3.0.0 is unsupported. Immediate migration to 2.2.x recommended. Details: radar.offseq.com/threat/unsupp

  • 0
  • 0
  • 0
  • 9h ago

CVE-2026-118235

Overview

  • wpazleen
  • SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications
31 Oct 2026
Published
31 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
0.74%
KEV

Description

The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.10.2 via the handle_upload function. This is due to missing server-side file key allowlist and pre-sanitization extension derivation that allows a trailing-dot filename to bypass all extension and MIME validation in handle_upload. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The only access control is a nonce that is printed into every public form's data-nonce attribute, making it trivially obtainable by any unauthenticated visitor on a page embedding the form shortcode.

Statistics

  • 1 Post
Last activity: 22 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

CVE-2026-118235: SimpleForm WP plugin ≤3.10.2 suffers CRITICAL file upload vuln (CVSS 9.8). Unauthenticated RCE possible due to weak validation and exposed nonce. Remove/disable plugin or restrict shortcode pages. radar.offseq.com/threat/the-si

  • 0
  • 0
  • 0
  • 22h ago
Showing 31 to 40 of 51 CVEs