VYPR

CVEs

408,171 total · page 1624 of 8,164

AllCriticalHighKEV
  • CVE-2026-4237HigMar 16, 2026
    Itsourcecode
    Free Hotel Reservation System
    risk 0.47cvss 7.3epss 0.00

    A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /hotel/admin/mod_reports/index.php. Executing a manipulation of the argument Home can lead to sql injection. The attack may be performed from remote. The…

  • CVE-2026-4236HigMar 16, 2026
    Itsourcecode
    Online Enrollment System
    risk 0.47cvss 7.3epss 0.00

    A security vulnerability has been detected in itsourcecode Online Enrollment System 1.0. Impacted is an unknown function of the file /enrollment/index.php?view=add. Such manipulation of the argument txtsearch/deptname/name leads to sql injection. The attack may be performed from…

  • CVE-2026-4235HigMar 16, 2026
    Itsourcecode
    Online Enrollment System
    risk 0.47cvss 7.3epss 0.00

    A weakness has been identified in itsourcecode Online Enrollment System 1.0. This issue affects some unknown processing of the file /sms/login.php. This manipulation of the argument user_email causes sql injection. The attack is possible to be carried out remotely. The exploit…

  • CVE-2026-4234MedMar 16, 2026
    Sscms
    Sscms
    risk 0.41cvss 6.3epss 0.00

    A security flaw has been discovered in SSCMS 7.4.0. This vulnerability affects unknown code of the file SitesAddController.Submit.cs of the component DDL Handler. The manipulation of the argument tableHandWrite results in sql injection. The attack can be executed remotely. The…

  • CVE-2026-4233MedMar 16, 2026
    ThingsGateway
    ThingsGateway
    risk 0.28cvss 4.3epss 0.00

    A vulnerability was identified in ThingsGateway 12. This affects an unknown part of the file /api/file/download. The manipulation of the argument fileName leads to path traversal. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.…

  • CVE-2026-4232HigMar 16, 2026
    Tiandy
    Easy7 Integrated Management Platform
    risk 0.47cvss 7.3epss 0.00

    A vulnerability was determined in Tiandy Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /rest/user/getAuthorityByUserId. Executing a manipulation of the argument userId can lead to sql injection. The attack may be launched…

  • CVE-2026-4231HigMar 16, 2026
    Vanna AI
    Vanna
    risk 0.47cvss 7.3epss 0.00

    A vulnerability was found in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is the function update_sql/run_sql of the file src/vanna/legacy/flask/__init__.py of the component Endpoint. Performing a manipulation results in server-side request forgery. The attack may…

  • CVE-2026-4230MedMar 16, 2026
    Vanna AI
    Vanna
    risk 0.41cvss 6.3epss 0.00

    A vulnerability has been found in vanna-ai vanna up to 2.0.2. Affected is the function update_sql of the file src/vanna/legacy/flask/__init__.py of the component Endpoint. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit has been…

  • CVE-2026-4229HigMar 16, 2026
    risk 0.47cvss 7.3epss 0.00

    A flaw has been found in vanna-ai vanna up to 2.0.2. This impacts the function remove_training_data of the file src/vanna/legacy/google/bigquery_vector.py. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been…

  • CVE-2026-4228MedMar 16, 2026
    Lb Link
    BL-WR9000
    risk 0.42cvss 6.3epss 0.13

    A vulnerability was detected in LB-LINK BL-WR9000 2.4.9. This affects the function sub_458754 of the file /goform/set_wifi. The manipulation results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was…

  • CVE-2026-4227HigMar 16, 2026
    Lb Link
    BL-WR9000
    risk 0.57cvss 8.8epss 0.01

    A security vulnerability has been detected in LB-LINK BL-WR9000 2.4.9. The impacted element is the function sub_44D844 of the file /goform/get_hidessid_cfg. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed…

  • CVE-2026-4226HigMar 16, 2026
    Lb Link
    BL-WR9000
    risk 0.57cvss 8.8epss 0.01

    A weakness has been identified in LB-LINK BL-WR9000 2.4.9. The affected element is the function sub_44E8D0 of the file /goform/get_virtual_cfg. Executing a manipulation can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been made…

  • CVE-2026-4225LowMar 16, 2026
    Feixuezhi
    CMS
    risk 0.16cvss 2.4epss 0.00

    A security flaw has been discovered in CMS Made Simple up to 2.2.21. Impacted is an unknown function of the file admin/listusers.php of the component User Management Module. Performing a manipulation of the argument Message results in cross site scripting. The attack is possible…

  • CVE-2026-4223HigMar 16, 2026
    Itsourcecode
    Payroll Management System
    risk 0.47cvss 7.3epss 0.00

    A vulnerability was identified in itsourcecode Payroll Management System 1.0. This issue affects some unknown processing of the file /manage_employee.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly…

  • CVE-2026-4222LowMar 16, 2026
    Sscms
    Sscms
    risk 0.25cvss 3.8epss 0.00

    A vulnerability was determined in SSCMS up to 7.4.0. This vulnerability affects the function PathUtils.RemoveParentPath of the file /api/admin/plugins/install/actions/download. This manipulation of the argument path causes path traversal. Remote exploitation of the attack is…

  • CVE-2026-4221HigMar 16, 2026
    Tiandy
    Easy7 Integrated Management Platform
    risk 0.47cvss 7.3epss 0.00

    A vulnerability was found in Tiandy Easy7 Integrated Management Platform 7.17.0. This affects an unknown part of the file /rest/file/uploadLedImage of the component Endpoint. The manipulation of the argument File results in unrestricted upload. The attack may be launched…

  • CVE-2026-4220HigMar 16, 2026
    Technologies Integrated
    Management Platform
    risk 0.47cvss 7.3epss 0.00

    A vulnerability has been found in Technologies Integrated Management Platform 7.17.0. Affected by this issue is some unknown functionality of the file /SetWebpagePic.jsp. The manipulation of the argument targetPath/Suffix leads to unrestricted upload. The attack may be initiated…

  • CVE-2026-4219LowMar 16, 2026
    INDEX Conferences & Exhibitions Organization
    YWF BPOF APGCS App
    risk 0.21cvss 3.3epss 0.00

    A flaw has been found in INDEX Conferences & Exhibitions Organization YWF BPOF APGCS App up to 1.0.2 on Android. Affected by this vulnerability is an unknown functionality of the file com/index/event/BuildConfig.java of the component ae.index.apgcs. Executing a manipulation of…

  • CVE-2026-4218LowMar 16, 2026
    MyAEDES App
    myAEDES App
    risk 0.16cvss 2.5epss 0.00

    A vulnerability was detected in myAEDES App up to 1.18.4 on Android. Affected is an unknown function of the file aedes/me/beta/utils/EngageBayUtils.java of the component aedes.me.beta. Performing a manipulation of the argument AUTH_KEY results in information disclosure. The…

  • CVE-2026-4217LowMar 16, 2026
    XREAL
    Nebula App
    risk 0.16cvss 2.5epss 0.00

    A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in ai/nreal/nebula/flutterPlugin/CloudStoragePlugin.java of the component ai.nreal.nebula.universal. Such manipulation of the argument…

  • CVE-2026-4216MedMar 16, 2026
    I Sens
    SmartLog App
    risk 0.34cvss 5.3epss 0.00

    A weakness has been identified in i-SENS SmartLog App up to 2.6.8 on Android. This affects an unknown function of the component air.SmartLog.android. This manipulation causes hard-coded credentials. The attack can only be executed locally. The exploit has been made available to…

  • CVE-2026-4215MedMar 16, 2026
    FlowCI
    flow-core-x
    risk 0.41cvss 6.3epss 0.00

    A security flaw has been discovered in FlowCI flow-core-x up to 1.23.01. The impacted element is the function Save of the file core/src/main/java/com/flowci/core/config/service/ConfigServiceImpl.java of the component SMTP Host Handler. The manipulation results in server-side…

  • CVE-2026-4214HigMar 16, 2026
    Dlink
    DNS-120
    risk 0.57cvss 8.8epss 0.01

    A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This issue affects the…

  • CVE-2026-4213HigMar 16, 2026
    Dlink
    DNS-320
    risk 0.57cvss 8.8epss 0.01

    A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This vulnerability…

  • CVE-2026-4212HigMar 16, 2026
    Dlink
    DNS-120
    risk 0.57cvss 8.8epss 0.01

    A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This…

  • CVE-2026-4211HigMar 16, 2026
    Dlink
    DNS-120
    risk 0.57cvss 8.8epss 0.01

    A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by this…

  • CVE-2026-4210MedMar 16, 2026
    Dlink
    DNS-120
    risk 0.41cvss 6.3epss 0.04

    A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected by…

  • CVE-2026-4209MedMar 16, 2026
    Dlink
    DNS-120
    risk 0.41cvss 6.3epss 0.07

    A vulnerability was identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the…

  • CVE-2026-4207MedMar 16, 2026
    Dlink
    DNS-120
    risk 0.41cvss 6.3epss 0.06

    A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the…

  • CVE-2026-4206MedMar 16, 2026
    Dlink
    DNS-120
    risk 0.41cvss 6.3epss 0.05

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects the…

  • CVE-2026-4205MedMar 16, 2026
    Dlink
    DNS-120
    risk 0.41cvss 6.3epss 0.04

    A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted…

  • CVE-2026-4204MedMar 16, 2026
    Dlink
    DNS-320
    risk 0.41cvss 6.3epss 0.04

    A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the…

  • CVE-2026-4203MedMar 16, 2026
    Dlink
    DNS-120
    risk 0.41cvss 6.3epss 0.04

    A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Impacted is the…

  • CVE-2026-4201HigMar 16, 2026
    risk 0.47cvss 7.3epss 0.01

    A weakness has been identified in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This vulnerability affects the function Upload of the file business/business-system/src/main/java/com/glowxq/system/admin/controller/SysFileController.java. Executing a…

  • CVE-2026-4200HigMar 16, 2026
    risk 0.47cvss 7.3epss 0.00

    A security flaw has been discovered in glowxq glowxq-oj up to 6f7c723090472057252040fd2bbbdaa1b5ed2393. This affects the function uploadTestcaseZipUrl of the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. Performing a…

  • CVE-2026-4199MedMar 16, 2026
    Bazinga012
    mcp_code_executor
    risk 0.28cvss 5.3epss 0.01

    A vulnerability was identified in bazinga012 mcp_code_executor up to 0.3.0. Affected by this issue is the function installDependencies of the file src/index.ts. Such manipulation leads to command injection. The attack can only be performed from a local environment. The exploit…

  • CVE-2026-4198MedMar 16, 2026
    Hypermodel Labs
    mcp-server-auto-commit
    risk 0.28cvss 5.3epss 0.01

    A vulnerability was determined in hypermodel-labs mcp-server-auto-commit 1.0.0. Affected by this vulnerability is the function getGitChanges of the file index.ts. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly…

  • CVE-2026-4197MedMar 16, 2026
    Dlink
    DNS-120
    risk 0.42cvss 6.3epss 0.19

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. Affected is the function…

  • CVE-2026-4196MedMar 16, 2026
    Dlink
    DNS-120
    risk 0.41cvss 6.3epss 0.04

    A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This impacts the…

  • CVE-2026-4195MedMar 16, 2026
    Dlink
    DNS-320
    risk 0.41cvss 6.3epss 0.04

    A flaw has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. This affects an unknown…

  • CVE-2026-4194HigMar 16, 2026
    Dlink
    DNS-120
    risk 0.48cvss 7.3epss 0.05

    A vulnerability was detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The impacted element…

  • CVE-2026-4193HigMar 16, 2026
    Dlink
    Dir 823x Firmware
    risk 0.48cvss 7.3epss 0.01

    A security vulnerability has been detected in D-Link DIR-823G 1.0.2B05. The affected element is the function GetDDNSSettings/GetDeviceDomainName/GetDeviceSettings/GetDMZSettings/GetFirewallSettings/GetGuestNetworkSettings/GetLanWanConflictInfo/GetLocalMacAddress/GetNetworkSetting…

  • CVE-2026-4192MedMar 16, 2026
    AvinashBole
    quip-mcp-server
    risk 0.41cvss 6.3epss 0.02

    A vulnerability has been found in AvinashBole quip-mcp-server 1.0.0. Affected by this vulnerability is the function setupToolHandlers of the file src/index.ts. Such manipulation leads to command injection. The attack may be performed from remote. The exploit has been disclosed…

  • CVE-2026-4191HigMar 16, 2026
    JawherKl
    node-api-postgres
    risk 0.47cvss 7.3epss 0.00

    A flaw has been found in JawherKl node-api-postgres up to 2.5. Affected is the function path.extname of the file index.js of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has…

  • CVE-2026-4190HigMar 16, 2026
    JawherKl
    node-api-postgres
    risk 0.47cvss 7.3epss 0.00

    A vulnerability was detected in JawherKl node-api-postgres up to 2.5. This impacts the function User.getAll of the file models/user.js. The manipulation of the argument sort results in sql injection. The attack can be executed remotely. The exploit is now public and may be used.…

  • CVE-2026-4189MedMar 16, 2026
    Phpipam
    Phpipam
    risk 0.31cvss 4.7epss 0.00

    A weakness has been identified in phpipam up to 1.7.4. The impacted element is an unknown function of the file app/admin/sections/edit-result.php of the component Section Handler. Executing a manipulation of the argument subnetOrdering can lead to sql injection. The attack may…

  • CVE-2026-4188HigMar 16, 2026
    Dlink
    DIR-619L
    risk 0.57cvss 8.8epss 0.00

    A security flaw has been discovered in D-Link DIR-619L 2.06B01. The affected element is the function formSchedule of the file /goform/formSchedule of the component boa. Performing a manipulation of the argument curTime results in stack-based buffer overflow. The attack may be…

  • CVE-2026-4187MedMar 16, 2026
    Tiandy
    Easy7 Integrated Management Platform
    risk 0.34cvss 5.3epss 0.01

    A vulnerability was identified in Tiandy Easy7 Integrated Management Platform 7.17.0. Impacted is an unknown function of the file /WebService/UpdateLocalDevInfo.jsp of the component Device Identifier Handler. Such manipulation of the argument username/password leads to missing…

  • CVE-2026-4186LowMar 16, 2026
    UEditor
    UEditor
    risk 0.23cvss 3.5epss 0.00

    A vulnerability was determined in UEditor up to 1.4.3.2. This issue affects some unknown processing of the file php/controller.php?action=uploadimage of the component JSONP Callback Handler. This manipulation of the argument callback causes cross site scripting. The attack can…

  • CVE-2026-4185MedMar 16, 2026
    Gpac
    Gpac
    risk 0.34cvss 6.3epss 0.00

    A vulnerability was found in GPAC up to 2.5-DEV-rev2167-gcc9d617c0-master. This vulnerability affects the function swf_def_bits_jpeg of the file src/scene_manager/swf_parse.c of the component MP4Box. The manipulation of the argument szName results in stack-based buffer overflow.…