WordPress Dental Care CPT plugin < 21.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Strongholdthemes Dental Care CPT dentalcare-cpt allows Object Injection.This issue affects Dental Care CPT: from n/a before 21.6.

An issue in Matomo v.5.11.2 allows a remote attacker to obtain sensitive information via the SiteContentDetector / SitesManager component. NOTE: the Supplier disputes the relevance of this report because the site administrator is a trusted party, and would not plausibly set main_url to a URL that offers additional information to an adversary.

YunaiV yudao-cloud get-by-website sql injection

A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as bccf7c79e5f93f027a021172a18e8876cc6c1062 (master-jdk17). It is advisable to implement a patch to correct this issue.

Authentication Bypass via Alternate Channel in Fortinet FortiSandbox Allowing Unauthorized Command Execution

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests

The reported issue is tracked under CVE-2026-18451. This CVE ID is rejected as a duplicate.

The reported issue is tracked under CVE-2026-18450. This CVE ID is rejected as a duplicate.

The reported issue is tracked under CVE-2026-18449. This CVE ID is rejected as a duplicate.

The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA.

The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA.

The reported issue was assessed as intended functionality. This CVE ID is unused by the CNA.

The reported issue could not be reproduced, and the affected products are end-of-life. This CVE ID is unused by the CNA.

The reported issue could not be reproduced. This CVE ID is unused by the CNA.

The reported issue could not be reproduced. This CVE ID is unused by the CNA.

The reported issue could not be reproduced. This CVE ID is unused by the CNA.

Windows NTFS Remote Code Execution Vulnerability

Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.

Microsoft Windows Search Component Elevation of Privilege Vulnerability

Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.

Windows Kernel Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Windows Server Update Service Elevation of Privilege Vulnerability

Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

Microsoft Windows Search Component Information Disclosure Vulnerability

Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.

Adobe Experience Manager | Improper Input Validation (CWE-20)

Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.