Everything Threat Times has reported about NVD: 22 stories, newest first. Part of our Vulnerabilities coverage.
The National Vulnerability Database lists a critical OS command injection flaw in Wavlink router firmware, noting that the exploit has been published and the vendor was notified early.
An unauthenticated SQL injection in phpMyFAQ versions before 4.1.9 allows attackers to steal credentials and drop database tables.
A critical flaw in IBM Maximo AI Service 9.1.0 and 9.2.0 allows remote attackers to run arbitrary code via improper control of code generation.
A high-severity vulnerability in the Windows client allows attackers to run local binaries via manipulated IPC bridges and unvalidated connections.
A critical vulnerability in NetEase Cloud Music for Windows allows attackers to intercept traffic and steal session credentials through man-in-the-middle attacks.
A critical flaw in the Grav Login OAuth plugin enables attackers to guess credentials and seize administrative control of affected websites.
A critical vulnerability in Progress MarkLogic Server lets attackers with query access run code with elevated permissions, according to NVD data.
Progress MarkLogic Server versions before 11.3.7 and 12.1.0 contain a critical vulnerability allowing privileged users to manipulate data beyond authorized limits.
An unauthenticated attacker can trigger arbitrary Ruby code execution in Square Squash by storing crafted YAML data via a public API endpoint.
The National Vulnerability Database rates CVE-2026-62031 as critical, affecting uListing versions up to 2.2.0 with unauthenticated SQL injection flaws.
The NVD rates CVE-2026-42716 as critical with a 9.8 score, affecting Payever WooCommerce Gateway versions up to 4.8.2 through unauthenticated object injection.
The National Vulnerability Database lists CVE-2026-62050 as a critical flaw allowing remote code execution in Splendour versions up to 1.23.
A severe vulnerability in the Juno WordPress theme allows attackers to execute code without authentication, affecting versions up to 2.25.
The NVD rates CVE-2026-62090 as critical, affecting WineShop versions up to 3.20 with a CVSS score of 9.8 due to unauthenticated PHP object injection vulnerabilities.
A critical vulnerability in Floci allows unauthenticated attackers to execute OS commands via unrestricted Velocity mapping templates in the VtlTemplateEngine.
The NVD assigned a CVSS score of 9.8 to CVE-2026-106610, a critical vulnerability allowing privilege escalation in miniOrange OTP verification versions up to 5.5.7.
A CVSS 9.8 vulnerability in the Rosalinda theme allows object injection, affecting versions up to 1.2.4 according to the National Vulnerability Database.
Version 2.4.0 of the self-hosted task manager Vikunja resolves a high-severity flaw where plaintext tokens allowed full account takeover if database access was compromised.
An unauthenticated stored cross-site scripting vulnerability in the Contao content management system allows attackers to execute scripts in the backend, affecting versions prior to 5.3.50 and 5.7.12.
A critical blind SQL injection vulnerability in the WPLMS plugin affects versions prior to 1.9.9.8.2, posing significant risks to site administrators.
The National Vulnerability Database rates an authentication bypass flaw in HPE Intelligent Management Center as critical, affecting versions prior to 7.3 E0713.
A critical buffer overflow vulnerability in IBM DataPower Gateway affects multiple software versions, carrying a CVSS score of 9.8.