CVE Vulnerabilities - 30 August 2026

The Tenda HG10 router’s web administration page has a coding mistake that lets an attacker send specially crafted data and overflow a memory area. This can be done from outside the network and may cau...

The router’s disk formatting feature can be tricked into overwriting memory, letting an attacker run their own code from anywhere on the internet. This could let a hacker take control of the device or...

The MyHome Core add‑on for WordPress lets anyone create a special link that logs in as any user, even an administrator, if the site uses the older WPBakery setup with front‑end registration turned on....

The A720R router’s MAC‑filtering feature can be tricked by sending a specially crafted request, causing the device’s memory to become corrupted. This can make the router stop working or become unstabl...

The Red Hat Hardened Images software includes several components that have known security weaknesses. If left unpatched, these weaknesses could let attackers gain unauthorized access or disrupt operat...

The erlef OIDC software that handles single‑sign‑on can treat an encrypted login token that lacks a proper signature (proof it really came from the trusted source) as valid. This allows an attacker to...

Older versions of SiYuan do not clean the text used for block names, aliases, and notes when showing hints, backlinks, or navigation paths. An attacker could insert HTML or script code into a block na...

Versions of SiYuan prior to 3.8.1 can be tricked into executing hidden scripts when a user removes a package or opens an encrypted notebook. An attacker could publish a package with a specially crafte...

Older versions of the Readest e‑book reader did not fully filter content inside an iframe's srcdoc attribute. This lets a malicious e‑book embed hidden code that can run and control the application. U...

The Pake tool (versions before 3.13.1) lets a program tell the system to save a file using any name the attacker chooses. By using special path tricks, the attacker can place the file outside the norm...

The Groundhogg CRM and marketing plugin for WordPress, versions before 4.5.13, does not properly clean data entered in certain form fields. This allows anyone on the internet to add hidden code that w...

The Customer Reviews add‑on for WooCommerce (versions before 5.118.0) does not properly clean the text that users submit in reviews. This means a stranger could place hidden scripts in a review that r...

When a client asks for a very large page of data using the "first" or "last" options, the system fails to limit how much it reads from the database. This can cause the server to become slow or stop re...

The AVideo video platform can return the passwords and URLs used to broadcast to services like YouTube, Facebook, and Twitch even to people who are not logged in. An attacker can create a fake token a...

Versions 3.1.0 through 3.6.25 of Keploy run a control‑plane web server that anyone on the network can reach. Through this server an attacker could download the TLS session keys used to encrypt traffic...

The Red Hat Hardened Images software includes several components that have known security weaknesses. If left unpatched, these weaknesses could let attackers gain unauthorized access or disrupt operat...

The Magma software version 1.9.0 has a mistake in a routine that confirms data integrity. An attacker on the network could trick the system into believing altered data is authentic. Update to a newer ...

In current versions of Qubes OS, copying a file from the main system (dom0) to another virtual machine can unintentionally run system commands if the target VM is controlled by an attacker. This happe...

Software that uses AshGraphQL can unintentionally include the names of hidden data fields in the error messages it sends back to users. This happens in versions from 1.9.0 up to but not including 1.11...

The Ash GraphQL service can be forced to stop working when a user sends a specially crafted request that includes an unknown type identifier. This causes the system to throw an unhandled error and may...

If you are using AshSql version 0.4.1 up to but not including 0.7.1, a rule that both limits related data and checks a user’s permission may be ignored. This means a user could be allowed access simpl...

Older AJCloud camera firmware lets anyone on the network request files stored on the device without logging in. This can reveal passwords, Wi‑Fi keys, device serial numbers and other private settings....

The Admidio web tool (versions older than 5.0.12) does not properly block public access to its RSS feeds for forum topics and announcements. As a result, anyone on the internet can view the titles, fu...

If you are using Admidio version older than 5.0.12, someone on the internet could trick the software into revealing the contents of your database, including user passwords. This can happen without nee...

The AVideo platform does not count login tries from users whose browser does not send a identifying name, so an attacker can keep trying passwords without being blocked. This makes it easier to guess ...