| CVE-2026-105191 | 보통4.3 | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and | 04/11/2026 |
| CVE-2026-104719 | 보통6.4 | The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content. | 04/11/2026 |
| CVE-2026-101166 | 낮음3.7 | The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal express-checkout endpoint, allowing unauthenticated users to order draft or unpublished products. | 04/11/2026 |
| CVE-2026-101165 | 낮음3.7 | The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured payment-surcharge fee, allowing unauthenticated users to reduce an order's total before completing payment. | 04/11/2026 |
| CVE-2025-11229 | 높음7.2 | The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain all API scopes, including sensitive internal and console scopes, without requiring explicit authorization, bypassing intended acce | 04/11/2026 |
| CVE-2026-105296 | 보통5.1 | Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed. | 04/11/2026 |
| CVE-2026-80335 | 높음7.6 | Memory Corruption when processing firmware update data in Download mode due to a missing bounds check. | 04/11/2026 |
| CVE-2026-79405 | 높음7.5 | Transient DOS when processing a malformed NR RRC configuration message due to improper input validation. | 04/11/2026 |
| CVE-2026-121802 | 심각9.1 | @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether that value had been issued by the server. NOTE: the application secret must be rotated after updating to a fixe | 04/11/2026 |
| CVE-2026-121618 | 보통5.3 | A weakness has been identified in Linksys E5600 1.1.0.26. This affects an unknown part of the file /cgi-bin/fqc.cgi of the component Factory Quality Control. This manipulation causes information disclosure. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be use | 04/11/2026 |
| CVE-2026-121617 | 높음7.5 | A security flaw has been discovered in Linksys E5600 1.1.0.26. Affected by this issue is the function init_multipart of the file /cgi-bin/upload_fw.cgi of the component Header Parser. The manipulation results in out-of-bounds write. The attack may be launched remotely. The exploit has been released to the public and ma | 04/11/2026 |
| CVE-2026-121616 | 보통5.3 | A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/mesh_login.cgi of the component JSON Request Parser. The manipulation of the argument username/password/token/source/cn/action leads to out-of-bounds write. The attack may be initiated re | 04/11/2026 |
| CVE-2026-121615 | 심각10.0 | A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Th | 04/11/2026 |
| CVE-2026-84730 | 높음8.7 | Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name.
Refer to the '
Security Update for ASUS Router AiCloud Feature ' section on the ASUS Security Advisory for more information. | 04/11/2026 |
| CVE-2026-84729 | 높음7.2 | Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS) via a crafted packet.
Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more informatio | 04/11/2026 |
| CVE-2026-121610 | 높음7.3 | A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The manipulation of the argument selectFields results in sql injection. The attack can be executed remotely. The exploit has been released to the pub | 04/11/2026 |
| CVE-2026-121609 | 심각10.0 | A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be use | 04/11/2026 |
| CVE-2026-121608 | 높음7.3 | A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of the component Timezone Push Handler. Executing a manipulation of the argument tz can lead to os command injection. The attack may be launched remotely. | 04/11/2026 |
| CVE-2026-121607 | 심각10.0 | A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing a manipulation of the argument host results in os command injection. The attack may be initiated remotely. The exploit has been made public and could be u | 04/11/2026 |
| CVE-2026-112116 | 높음8.5 | An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through crafted device control requests, ultimately resulting in a complete compromise of the affected system.
Refer to the ' Security Update for ASUS System | 04/11/2026 |