twcert

Latest CVEs · RSS

• CVE-2026-110467 2026-10-14 · CVSS 5.3
  Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view
• CVE-2026-110466 2026-10-14 · CVSS 5.3
  Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and ob
• CVE-2026-110465 2026-10-14 · CVSS 5.3
  Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alte
• CVE-2026-110445 2026-10-14 · CVSS 8.6
  TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with c
• CVE-2026-110444 2026-10-14 · CVSS 8.6
  TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted
• CVE-2026-107459 2026-10-08 · CVSS 9.3
  The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute
• CVE-2026-102459 2026-09-30 · CVSS 5.1
  EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes i
• CVE-2026-102458 2026-09-30 · CVSS 9.3
  EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords thro
• CVE-2026-102457 2026-09-30 · CVSS 7.1
  EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary
• CVE-2026-102456 2026-09-30 · CVSS 7.1
  EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database content
• CVE-2026-102455 2026-09-30 · CVSS 9.3
  EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by se
• CVE-2026-102454 2026-09-30 · CVSS 8.6
  EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby e
• CVE-2026-97181 2026-09-24 · CVSS 6.9
  GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs.
• CVE-2026-15027 2026-09-23 · CVSS 8.6
  CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page an
• CVE-2026-93468 2026-09-18 · CVSS 8.7
  The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary
• CVE-2026-93467 2026-09-18 · CVSS 9.3
  The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sendi
• CVE-2026-90891 2026-09-14 · CVSS 6.8
  ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a spec
• CVE-2026-90890 2026-09-14 · CVSS 6.8
  ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send
• CVE-2026-89180 2026-09-14 · CVSS 8.7
  EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands t
• CVE-2026-89179 2026-09-11 · CVSS 5.3
  WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the
• CVE-2026-89178 2026-09-11 · CVSS 8.7
  WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same networ
• CVE-2026-89177 2026-09-11 · CVSS 8.7
  WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unaut
• CVE-2026-89176 2026-09-11 · CVSS 8.7
  WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the sam
• CVE-2026-89175 2026-09-11 · CVSS 6.9
  Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can b
• CVE-2026-89174 2026-09-11 · CVSS 8.7
  Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers c