CVE-2026-18449 is a vulnerability in SMCI X12SPI version 01.07.20 where the Baseboard Management Controller (BMC) fails to properly enforce integrity and encryption for IPMI commands. This flaw allows an attacker to craft malicious packets that can execute arbitrary commands on an active session without requiring privileges or user interaction. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-107472 is an out-of-bounds read vulnerability in the QTextCodec TSCII encoding component of the Qt 5 Compatibility APIs module. This flaw affects Qt versions from 4.0.0 up to 6.8.8 and from 6.9.0 up to 6.11.2. Applications converting text to TSCII encoding via QTextCodec may read memory beyond the input buffer, potentially causing crashes or incorrect data interpretation. The vulnerability has a medium severity score of 4.3 and does not have known exploits in the wild.
CVE-2026-16521 is an OS command injection vulnerability in the SMCI MBD-X12STW-F product due to insufficient input filtering. An attacker with high privileges can inject malicious commands into a BMC function, which may execute when the related service is restarted. This vulnerability affects version 01.02.08 of the product and has a high severity score of 7.2.
CVE-2026-111461 is an OS command injection vulnerability in the Moxa OnCell G3150A-LTE Series devices. It occurs when the SMS management functionality is enabled and configured. A remote attacker with required privileges can exploit insufficient input validation in this functionality to execute arbitrary commands on the device. The vulnerability has a high severity with a CVSS score of 7.5.
CVE-2026-101034 is a vulnerability in Broadcom Symantec Ghost Solution Suite where hardcoded keys allow attackers to decrypt sensitive credentials such as domain/service account passwords, task run-as credentials, and sysprep passwords stored or transmitted by the GSS Deployment Server installation. This vulnerability could lead to unauthorized access to critical credentials.
The Blue Initiative is a newly launched public vulnerability database indexing nearly 30,000 IT and OT vulnerabilities relevant to maritime systems, including ships and ports. It includes 37 vulnerabilities specific to maritime products and aggregates data from sources like CISA's ICS advisories and KEV catalog. The database aims to help maritime organizations identify and prioritize vulnerabilities affecting their systems by providing a focused and accessible source of maritime-related cybersecurity risks.
CVE-2026-111460 is a vulnerability in the Moxa OnCell G3150A-LTE Series involving a hard-coded cryptographic key. An unauthenticated remote attacker could potentially obtain this key material and impersonate devices that have not regenerated their keys, risking confidentiality and integrity of management communications. The vulnerability affects version 1.0.0 of the product. The CVSS 4.0 score is 7.7, indicating a high severity. No patch or remediation information is provided.
CVE-2026-111459 is an improper certificate validation vulnerability in Moxa Remote Connect Suite (MRC Client) versions 1.0.0 through 4.2.0. This flaw allows an unauthenticated attacker with on-path access to impersonate a trusted server and perform a man-in-the-middle attack, risking the confidentiality and integrity of communications.
A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.
CVE-2026-105946 is an out-of-bounds read vulnerability in the QAuthenticator NTLM authentication handling within the Qt Network module. It affects applications using QNetworkAccessManager or QTcpSocket that authenticate with NTLM. A malicious server or proxy can send a crafted NTLM challenge to trigger this flaw, potentially exposing sensitive heap memory contents or causing an application crash. The vulnerability affects Qt versions from 6.8.0 up to but not including 6.8.10, and from 6.9.0 up to but not including 6.11.2. Fixed versions are 6.8.10 and 6.11.2. The CVSS 4.0 score is 5.3, indicating medium severity.
The TiendaCrypto para WooCommerce WordPress plugin versions 1.0.1 through 1.2.1 improperly verify payment webhook authenticity by validating the request signature against an always-empty key. This flaw allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.
CVE-2026-103359 is a vulnerability in the PayDunya WooCommerce Payment Gateway WordPress plugin up to version 1.1.6. The plugin fails to verify the authenticity of incoming payment notifications properly. Until the gateway is configured, it uses a value derived from an empty secret for authentication, which can be computed by anyone. This flaw allows unauthenticated attackers to mark arbitrary WooCommerce orders as paid and completed without authorization.
The qs library versions 6.12.0 through 6.16.1 have a vulnerability in the stringify function when used with the allowEmptyArrays option enabled. Keys of empty arrays are not properly encoded, allowing special characters like &, =, and # in keys to be interpreted as query string syntax rather than data. This can lead to injection of additional parameters or truncation of the query string. The issue is fixed in version 6.17.0.
The Kirki plugin for WordPress up to version 6.2.5 contains a vulnerability that allows privilege escalation via PHP object injection. Authenticated users with Subscriber-level access or higher can exploit a missing capability check in the 'get-single-symbol' AJAX dispatcher branch to inject malicious PHP objects. This can lead to overwriting an administrator's password and gaining administrative access.
Psono Server CE and EE versions 4.0.33 through 7.2.3 have an authorization bypass vulnerability in deployments using URL_PREFIX. The server incorrectly authorizes POST requests to the bulk-secret-read endpoint with write scope instead of read scope, allowing an authenticated attacker with a write-enabled but read-disabled API key to retrieve encrypted secret data and nonces. Default configurations without URL_PREFIX are not affected.
The Payex Payment Gateway for Woocommerce WordPress plugin versions through 1.2.10 fails to properly verify the authenticity of incoming payment notifications. This is due to reliance on a validation secret that is empty by default, which allows unauthenticated attackers to forge payment confirmations and mark orders as paid without authorization.
Psono Server CE and EE versions 0.1.0 through 7.2.3 contain a vulnerability where an authenticated user can specify a host when configuring a personal Duo device. The server connects to the specified host over HTTPS without an allowlist or explicit timeout, enabling an internal DNS and service-reachability oracle. TLS certificate validation is enforced, and arbitrary protocols or ports are not accessible. Unresponsive targets can cause server worker resource exhaustion until the OS timeout occurs.
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 contain a vulnerability where the direction of file-transfer credentials is not enforced on file-repository operations. This flaw allows an authenticated attacker with read-only access to a file to misuse the upload endpoint to append data to files, potentially overwriting repository objects and consuming storage within certain operational limits.
The Payment Integration Wompi WordPress plugin up to version 4.0.1 fails to verify the authenticity of incoming payment notifications by default. This occurs because the callback's checksum relies on a merchant secret that is empty until manually configured. As a result, an unauthenticated attacker can forge payment notifications and mark arbitrary orders as paid.
Psono Server versions 5.3.5 through 7.2.3 contain a vulnerability where a permission class fails to enforce token write scope when claiming a device code. An authenticated attacker with a restricted API key-derived session can claim a device code they control and escalate to a full read-write session valid for up to 365 days. This escalation bypasses the original token's scope and lifetime restrictions but does not bypass two-factor authentication or disclose plaintext secrets.