Threat database

CVE-2026-75896 is a critical vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute's Liderahenk product prior to version 3.5.5. It involves the use of hard-coded credentials, allowing attackers to use common or default usernames and passwords to gain unauthorized access. The vulnerability has a high CVSS score of 9.1, indicating severe confidentiality and integrity impacts without requiring user interaction or privileges. No official patch or remediation guidance is currently available from the vendor.

Mailgun for WordPress plugin versions up to and including 2.2.0 contain a critical Server-Side Request Forgery (SSRF) vulnerability due to insufficient input validation in the add_list() function. This flaw allows unauthenticated attackers to leverage the WordPress site's Mailgun API key to send authenticated POST requests to any Mailgun API endpoint. Exploitation can lead to creation of inbound email-forwarding routes, enabling interception of password reset emails and potential administrator account takeover.

CVE-2026-15599 is an unverified ownership vulnerability in the pardus-domain-joiner software developed by TÜBİTAK BİLGEM Software Technologies Research Institute. This flaw allows privilege abuse due to improper verification of ownership. It affects versions prior to 0.5.5. The vulnerability has a low severity rating with a CVSS score of 3.3 and does not impact confidentiality or integrity but may affect availability. No official patch or remediation guidance has been published yet.

CVE-2026-18915 is a vulnerability in the eta-otp-lock software by TÜBİTAK BİLGEM Software Technologies Research Institute that involves invocation of a process using visible sensitive information. This flaw allows system footprinting and affects versions prior to 1.0.4. The vulnerability has a medium severity rating with a CVSS score of 5. There is no official patch or remediation level currently provided by the vendor.

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 0.9.0.

CVE-2026-15929 is a high-severity SQL injection vulnerability in LG Electronics SmartShare affecting versions up to and including 2.3.1712.1202. The flaw involves improper neutralization of special elements in SQL commands, which could allow an attacker to manipulate database queries. This vulnerability affects SmartShare running on Microsoft Windows 10 and earlier versions. No official patch or remediation guidance has been provided yet.

Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions.

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0.

A vulnerability has been found in yashbhalgat HashNeRF-pytorch up to 82885e698295982504eb6a26d060a6b2473e3706. Affected by this issue is the function torch.load of the file run_nerf.py of the component Checkpoint File Handler. The manipulation of the argument ckpt_path leads to deserialization. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The pull request to fix this issue awaits acceptance.

The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the `manage_options` capability to the `backstage_customizer_user` demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyond the Customizer and update arbitrary WordPress options such as `default_role`, leading to privilege escalation.

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation. This issue affects Pardus Update: from <=0.6.3 before 0.6.6.

Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing. This issue affects Pardus-Parental-Control: from <=0.5.1 before 0.7.0.

Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Overflow Buffers. This issue affects Pardus Pen: from <=4.1.5 before 4.2.1.

Invocation of process using visible sensitive information vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner allows Excavation. This issue affects Pardus Domain Joiner: from 0.5.2 before 0.5.4.

Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from <= 1.0.4 before 1.0.5.

Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from <= 1.0.4 before 1.0.5.

The Product Video Gallery for Woocommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom_thumbnail Parameter in all versions up to, and including, 1.5.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.