Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.
CVE-2026-21553 is a high-severity vulnerability in the modems of Unisoc (Shanghai) Technologies Co., Ltd. models T8100, T9100, T8200, and T8300. It involves improper input validation that could allow a remote attacker to cause a denial of service without requiring any privileges or user interaction.
CVE-2026-21552 is a high-severity vulnerability in the modem components of Unisoc (Shanghai) Technologies Co., Ltd. products T8100, T9100, T8200, and T8300. It involves improper input validation that could allow a remote attacker to cause a denial of service without requiring any privileges or user interaction.
CVE-2026-21551 is a high-severity vulnerability in the modem components of Unisoc (Shanghai) Technologies Co., Ltd. products T8100, T9100, T8200, and T8300. The issue arises from improper input validation, which could allow a remote attacker to cause a denial of service without requiring any additional execution privileges. No information about patches or fixes is currently available.
CVE-2026-21550 is a high-severity vulnerability in the modem components of Unisoc (Shanghai) Technologies Co., Ltd. products T8100, T9100, T8200, and T8300. It involves improper input validation that could allow a remote attacker to cause a denial of service without requiring any additional execution privileges. No information about patches or fixes is currently available.
CVE-2026-21549 is a high-severity vulnerability in Unisoc (Shanghai) Technologies Co., Ltd. modem products T8100, T9100, T8200, and T8300. It involves improper input validation that could lead to a remote denial of service (DoS) without requiring any additional execution privileges. No confidentiality or integrity impact is indicated. No patch or official remediation guidance is currently available.
CVE-2026-21548 is a high-severity vulnerability in Unisoc (Shanghai) Technologies Co., Ltd. modem products T8100, T9100, T8200, and T8300. It involves improper input validation in the NR modem component, which could allow a remote attacker to cause a denial of service without requiring user interaction or privileges. The vulnerability does not impact confidentiality or integrity but can disrupt availability by causing a system crash or reboot.
BaserCMS, a content management system by baserCMS Users Community, has a CSV file injection vulnerability. This flaw allows malicious code to be injected into CSV files generated by the system. When a user downloads and opens such a CSV file, the embedded malicious code may be executed, potentially leading to data confidentiality, integrity, and availability impacts.
The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsive_thumbnail_image_management() function, which echoes $_GET['id'] directly into a double-quoted HTML attribute with no esc_attr() call. The only guard is a loose PHP numeric comparison ($_GET['id']>0) that a string beginning with a numeric prefix trivially satisfies, and the addslashes() applied by wp_magic_quotes() is inert in HTML-attribute context because backslash is not an HTML escape character. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection.
This issue affects Logsign SIEM: before 6.4.115.
The Fluent Forms WordPress plugin up to version 6.2.8 contains an authorization bypass vulnerability via the 'transaction' parameter. This flaw allows unauthenticated attackers to brute-force transaction hashes and access sensitive payment receipt data of other users, including personal and payment details. The vulnerability arises from missing validation on a user-controlled key, enabling insecure direct object reference attacks. The brute-force attack is practical due to a limited candidate space of about 900 possibilities per second per submission and form pair.
A cross-site scripting (XSS) vulnerability exists in the AdonisJS HTTP Server package versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2. The error.message is directly interpolated into the default HTML exception response without proper escaping, allowing attacker-controlled JavaScript execution when a crafted missing-route URL is accessed and no custom error handling is in place. This issue is fixed in versions 8.2.1 and 9.1.0.
CVE-2026-7849 is a critical command injection vulnerability in Phoenix Contact's CHARX SEC-3150 device. An unauthenticated remote attacker can inject commands into the system configuration, which are executed with root privileges. This flaw affects versions 1.0.0 up to but not including 1.9.1. The issue is fixed in version 1.9.1.
Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these services, resulting in full system compromise.
A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack.
CVE-2026-44105 is a vulnerability in Phoenix Contact CHARX SEC-3150 devices where credentials for the local user "user-app" are inserted into log files. This exposure allows a low-privileged local attacker with access to these logs to authenticate via SSH as the limited user "user-app", potentially disrupting charging operations.
A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.