VulDB Recent Entries

A vulnerability, which was classified as problematic, has been found in Paymenter up to 1.4.x. Impacted is an unknown function of the component Email Update. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-44584. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability classified as problematic was found in VSee Clinic. This issue affects some unknown processing of the component SFTP. Executing a manipulation can lead to missing encryption of sensitive data. This vulnerability appears as CVE-2026-13380. The attack may be performed from remote. There is no available exploit.

A vulnerability classified as problematic has been found in freescout up to 1.8.223. This vulnerability affects unknown code of the component Path Resolution. Performing a manipulation of the argument dl results in path traversal. This vulnerability is reported as CVE-2026-53594. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability described as problematic has been identified in Paymenter up to 1.5.0. This affects an unknown part of the component Checkout Livewire. Such manipulation of the argument checkoutConfig leads to improper input validation. This vulnerability is documented as CVE-2026-47198. The attack can be executed remotely. There is not any exploit available.

A vulnerability marked as critical has been reported in Paymenter up to 1.4.x. Affected by this issue is the function file_get_contents of the file /extensions/paypal/webhook of the component PayPal webhook endpoint. This manipulation of the argument PAYPAL-CERT-URL causes server-side request forgery. This vulnerability is registered as CVE-2026-44583. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability labeled as critical has been found in FreeScout up to 1.8.223. Affected by this vulnerability is the function OpenController@userSetupSave of the component User Setup. The manipulation of the argument invite_hash/invite_sent_at results in improper authentication. This vulnerability is cataloged as CVE-2026-53595. The attack may be launched remotely. There is no exploit available.

A vulnerability identified as problematic has been detected in Paymenter up to 1.5.4. Affected is the function lockForUpdate of the file app/Livewire/Invoices/Show.php of the component Payment. The manipulation leads to race condition. This vulnerability is listed as CVE-2026-55219. The attack may be initiated remotely. There is no available exploit.

A vulnerability categorized as problematic has been discovered in FreeScout up to 1.8.223. This impacts an unknown function of the component file upload endpoint. Executing a manipulation can lead to denial of service. This vulnerability is tracked as CVE-2026-53596. The attack can be launched remotely. No exploit exists.

A vulnerability was found in Best Practical RT up to 5.0.9/6.0.2. It has been rated as problematic. This affects an unknown function of the component URL Handler. Performing a manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-44230. The attack can be initiated remotely. There is not any exploit available.

A vulnerability was found in Best Practical RT up to 5.0.9/6.0.2. It has been declared as problematic. The impacted element is an unknown function of the component Upload. Such manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-44229. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in RVC-Boss GPT-SoVITS up to 20250606v2pro. It has been classified as critical. The affected element is the function ASR/slice/denoise/uvr5 of the file webui.py of the component WebUI. This manipulation of the argument path causes os command injection. The identification of this vulnerability is CVE-2026-63766. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in dotCMS up to 26.06.22-03 and classified as critical. Impacted is an unknown function of the component ToolGroupResource/RoleAjax. The manipulation results in improper authorization. This vulnerability was named CVE-2026-16337. The attack may be performed from remote. There is no available exploit.

A vulnerability has been found in kvcache-ai ktransformers up to 0.6.2 and classified as critical. This issue affects the function __reduce__ of the component SchedulerServer. The manipulation leads to deserialization. This vulnerability is uniquely identified as CVE-2026-63767. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability, which was classified as problematic, was found in Best Practical RT up to 5.0.9/6.0.2. This vulnerability affects unknown code of the component REST API. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-2026-44231. The attack can be executed remotely. There is not any exploit available.

A vulnerability, which was classified as problematic, has been found in moby BuildKit up to 0.31.1. This affects an unknown part of the component Cache. Performing a manipulation of the argument Source results in information disclosure. This vulnerability is known as CVE-2026-15788. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability classified as problematic was found in FreeScout up to 1.8.222. Affected by this issue is some unknown functionality. Such manipulation of the argument last_reply_from leads to injection. This vulnerability is traded as CVE-2026-53591. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as critical has been found in FreeScout up to 1.8.222. Affected by this vulnerability is an unknown functionality of the file public/js/main.js of the component getQueryParam. This manipulation causes improperly controlled modification of object prototype attributes. This vulnerability appears as CVE-2026-53592. The attack may be initiated remotely. There is no available exploit.

A vulnerability described as critical has been identified in FreeScout up to 1.8.223. Affected is the function SecureController@upload of the file /uploads/upload of the component Helper. The manipulation of the argument restricted_extensions results in unrestricted upload. This vulnerability is reported as CVE-2026-53593. The attack can be launched remotely. No exploit exists.

A vulnerability marked as problematic has been reported in vastsa FileCodeBox up to 2.3. This impacts an unknown function of the component IPRateLimit. The manipulation of the argument X-Real-IP/X-Forwarded-For leads to information disclosure. This vulnerability is documented as CVE-2026-64619. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as problematic has been found in vrana Adminer up to 5.4.2. This affects an unknown function of the component Cookie. Executing a manipulation of the argument X-Forwarded-Prefix can lead to permissive cross-domain policy with untrusted domains. This vulnerability is registered as CVE-2026-63771. It is possible to launch the attack remotely. No exploit is available.