CVE-2026-49510

Integer Overflow in rlottie Enables Malicious Animation Parsing

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks. This issue affects rlottie: before 21292665023e5074b38254432716866d00f1985f.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Open Source

Products

Rlottie

CVE-2026-47306

Uncontrolled Recursion Leading to Oversized Serialized Data Payloads in rlottie

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. This issue affects rlottie: before e2d19e3b150e0e4a9586fa90b56fd3061cc98945.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Open Source

Products

Rlottie

CVE-2026-47318

Stack-Based Buffer Overflow in Samsung Open Source rlottie Library

Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before ce72b35a7ad0dded03051d3aa0ef75321c3bd035.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Open Source

Products

Rlottie

CVE-2026-8916

Out-of-Bounds Write Exploits Buffer Overflow in Samsung rlottie

Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: before dcfde72eae1b0464dc0dd760aec00ada6a148635.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Samsung Open Source

Products

Rlottie

CVE-2026-4104

SQLi in Akmer Informatics' TeknoPass

Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co. TeknoPass allows SQL Injection. This issue affects TeknoPass: from 20210501 through 20260429.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Akmer

Products

Teknopass

CVE-2025-59874

HCL Hive Telco Observability is affected by  a Required directives missing from the CSP .

HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Hive

CVE-2025-62338

HCL BigFix Cloud Lifecycle Management is affected by lack of input validation

HCL BigFix Cloud Lifecycle Management is affected by lack of input validation.  This low-level flaw allows unauthorized access and may lead to information exposure.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Bigfix Cloud Lifecycle Management

CVE-2019-25726

All in One Video Downloader 1.2 SQL Injection via admin page-edit

All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send requests to the admin interface with UNION-based SQL injection payloads in the id parameter to extract sensitive database information including usernames, databases, and version details.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Nicheoffice

Products

All In One Video Downloader

CVE-2019-25727

WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download

WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the path parameter. Attackers can send GET requests to the edit.php endpoint with export=export_csv and a malicious path parameter to read arbitrary files like wp-config.php accessible to the web server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ad-manager-wd Wordpress

Products

Ad Manager Wd Wordpress

CVE-2019-25729

PDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie

PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting PHP commands through the CSRF-TOKEN cookie parameter. Attackers can craft malicious cookie values containing template injection payloads like shell_exec() to execute system commands and retrieve sensitive information from the server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Simcy Creative

Products

Pdf Signer

CVE-2019-25730

Listing Hub CMS 1.0 SQL Injection via pages.php id

Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to pages.php with crafted id values using error-based SQL injection techniques to extract database credentials, usernames, and version information.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Themerig

Products

Listing Hub Cms

CVE-2019-25732

PHP EI-Tube Script 3 SQL Injection via search parameter

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search parameter. Attackers can send GET requests to the search endpoint with crafted SQL payloads in the query parameter to extract sensitive database information including usernames, passwords, and version details.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Eitube

Products

Ei-tube

CVE-2026-5228

Improper Access Control in Kurt Software Studio's WriteUp Mobile App

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Kurt Software Studio

Products

Writeup Mobile App

CVE-2026-41178

OpenTelemetry-Go's baggage parsing no longer caps raw header length

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opentelemetry

Products

Opentelemetry Opentelemetry-go

CVE-2025-59610

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Qualcomm

Products

5g Fixed Wireless Access Platform 5g Fixed Wireless Access Platform Firmware C-v2x 9150 and 470 more

CVE-2025-10439

SQLi in Yordam Library Automation System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yordam Informatics Yordam Library Automation System allows SQL Injection. This issue affects Yordam Library Automation System: from 21.5 & 21.6 before 21.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Yordam

Products

Library Automation System

CVE-2025-10449

Path Traversal in Saysis Computer Systems' Saysis Web Portal

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saysis Computer Systems Trade Ltd. Co. Saysis Web Portal allows Path Traversal. This issue affects Saysis Web Portal: from 3.1.9 & 3.2.0 before 3.2.1.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-10463

Improper Authentication in Birtech Information Technologies' Sensaway

Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Authentication Abuse. This issue affects Senseway: through 09022026.  NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Birtech Information Technologies Industry And Trade

Products

Senseway

CVE-2025-10464

Cleartext password storage in Birtech Information Technologies' Sensaway

Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Birtech Information Technologies Industry And Trade

Products

Senseway

CVE-2025-10465

Unrestricted File Upload in Birtech Information Technologies' Sensaway

Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Sensaway allows Upload a Web Shell to a Web Server. This issue affects Sensaway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Birtech Information Technologies Industry And Trade

Products

Sensaway