CVE-2026-12189

Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme

A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component com.tranzmate. Executing a manipulation can lead to improper authorization in handler for custom url scheme. The attack can only be executed locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Moovit

Products

Bus & Public Transit App Bus Public Transit App

CVE-2026-50100

Printer Driver Privilege Escalation via Malicious Driver

Multiple printer drivers provided by Ricoh Company, Ltd. and KONICA MINOLTA JAPAN, INC. contain a privilege escalation vulnerability. If this vulnerability is exploited, an attacker who can log in to a computer running an affected printer driver could elevate privileges by using a specially crafted driver.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Konica Minolta Ricoh

Products

Multiple Printer Drivers Multiple Printer Drivers

CVE-2026-34021

Lack of cryptographic protection in Wertheim SafeController 5400 enables RS-485 message sniffing and replay

The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the microcontroller without cryptographic protection. An attacker with access to the communication path between the server and the microcontroller can sniff RS-485 messages and replay previously observed messages. This can be used, for example, to spoof a "quit alarm" message and continuously deactivate the safe alarm.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller 5400 Hardware For Vault Rooms (safe Deposit Locker System - Microcontroller)

CVE-2026-34022

Weak custom cryptography and hard-coded keys in Wertheim SafeController 65000 allow traffic decryption

The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with hard-coded cryptographic keys to protect communication. An attacker in an adversary-in-the-middle position can decrypt the data traffic. During reassessment, it was possible to break the encryption/decryption routine and decrypt messages without knowledge of the encryption key. It was also possible to gain knowledge about the encryption key by intercepting enough messages.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Family 65000 Hardware For Vault Rooms (safe Deposit Locker System - Microcontroller)

CVE-2026-34023

Broken WebSocket authorization in Wertheim SafeController Software allows cross-branch access to restricted functions

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket communication used by the SafeController WebMessageBroker. An authenticated attacker with valid low-privileged branch user credentials can manipulate WebSocket messages by specifying controller identifiers belonging to other branches. This allows the attacker to access restricted functions and resources in other branches, including activating boxes outside of the user's authorized branch.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34024

Missing authorization checks in Wertheim SafeController Software allow low-privileged users to access restricted functions

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints. An authenticated attacker with minimal privileges can access endpoints that are not visible in the frontend but remain directly reachable. This allows the attacker to perform restricted actions such as switching the user's branch, uploading arbitrary files, downloading arbitrary files, and viewing details of arbitrary branches.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34025

IP restriction bypass in Wertheim SafeController Software allows logins from unauthorized network locations

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an IP restriction bypass vulnerability in the login process. The application restricts user logins based on the IP address associated with a branch location, but the client IP address is derived from the HTTP X-Forwarded-For header when that header is present. An attacker with valid branch user credentials can manipulate the X-Forwarded-For header during login to spoof the expected branch IP address and obtain a valid authenticated session from an unauthorized network location.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34026

Path traversal in Wertheim SafeController Software allows authenticated users to download arbitrary files

Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a path traversal vulnerability in the documentName parameter of the /safe/selfservice/openselfservicedocument endpoint. The application constructs a file path using attacker-controlled input without sufficient validation, allowing an authenticated attacker with any role or permission level to traverse out of the intended document directory and download arbitrary files accessible to the application. This includes, but is not limited to, application log files containing sensitive information and application binaries.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34027

Upload restriction bypass in Wertheim SafeController Software allows authenticated users to upload arbitrary files

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains insufficient server-side file type validation in the /safe/contract/uploadcustomdocuments endpoint. The application validates uploaded files based on the user-controlled HTTP Content-Type value and accepts the upload if this value contains an allowed string such as pdf, jpeg, tiff, or png. An authenticated attacker with any role or permission level can spoof the Content-Type value and upload arbitrary file content.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34028

Unauthenticated direct access to web data in Wertheim SafeController Software exposes files

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme. An unauthenticated attacker can directly access HTTP endpoints to download files from locations such as /Resources/CompanyId_[ID]/Audio/ and /SafeData/.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34029

Hard-coded cryptographic key in Wertheim SafeController Software allows decryption of sensitive configuration data

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains a hard-coded cryptographic key in the SafeSystem.Infrastructure.Security.dll component. An attacker with access to the application files can reverse engineer the DLL and recover the hard-coded cryptographic key. This key can be used to decrypt the licence.whs file, which contains sensitive information about the licensing party and a second key that can be used to decrypt other configuration files.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-34030

Improper branch-code validation in Wertheim SafeController Software allows file path manipulation

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch code is later used in multiple application functions, including filesystem path generation for uploaded files, profile pictures, and settings. An authenticated attacker with the settings_branches_manage privilege can include path traversal sequences in the branch code and influence the final filesystem location used by affected file operations. This can allow files to be stored in unintended locations, subject to service-account write permissions and branch-code length restrictions.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wertheim

Products

Safecontroller Software For Vault Rooms (safe Deposit Locker System)

CVE-2026-12057

DoS + Remote Code Execution via PDF JavaScript in Foxit AI

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Foxit Foxitsoftware

Products

Ai Foxit Ai

CVE-2016-20072

BBS e-Franchise 1.1.1 WordPress Plugin SQL Injection via uid

BBS e-Franchise 1.1.1 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the uid parameter. Attackers can craft requests to pages using the plugin's shortcode with UNION-based SQL injection in the uid parameter to extract sensitive data from the WordPress database including user information and taxonomy terms.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Bbsetheme Wordpress

Products

Bbs E-franchise Wordpress

CVE-2016-20073

Answer My Question 1.3 Plugin WordPress SQL Injection via modal.php

Answer My Question 1.3 plugin for WordPress contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' POST parameter. Attackers can submit crafted SQL statements to the modal.php endpoint to extract sensitive database information including WordPress terms and configuration data.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mattkaye Wordpress

Products

Answer My Question Wordpress

CVE-2016-20077

WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php

WordPress Plugin Photocart Link 1.6 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in decode.php. Attackers can supply base64-encoded file paths in the 'id' parameter to the decode.php endpoint to retrieve sensitive files like wp-config.php containing database credentials and configuration data.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Kaymeephotography Wordpress

Products

Photocart Link Wordpress

CVE-2016-20079

WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php

WordPress Dharma Booking 2.28.3 and earlier contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the gateway parameter. Attackers can supply file paths with directory traversal sequences or null byte injection to the gateway parameter in proccess.php to read sensitive files like configuration and system files.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jamie Wordpress

Products

Dharma Booking Wordpress

CVE-2016-20080

WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php

WordPress Brandfolder plugin version 3.0 and earlier contains a local file inclusion vulnerability in callback.php that allows unauthenticated attackers to include arbitrary files by manipulating the wp_abspath parameter. Attackers can supply path traversal sequences or remote URLs through the wp_abspath parameter to read sensitive files like wp-config.php or execute remote code.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Brandfolder Wordpress

Products

Brandfolder Wordpress

CVE-2016-20082

WordPress Plugin Abtest Local File Inclusion via abtest_admin.php

WordPress Plugin Abtest contains a local file inclusion vulnerability that allows unauthenticated attackers to include arbitrary files by manipulating the action parameter. Attackers can send GET requests to abtest_admin.php with malicious action values to include files from the admin directory and execute arbitrary code.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Abtest Wordpress

Products

Abtest Wordpress

CVE-2016-20083

WordPress More Fields Plugin 2.1 Cross-Site Request Forgery

WordPress More Fields Plugin 2.1 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by disabling CSRF token validation. Attackers can craft malicious web pages that trick logged-in administrators into adding or deleting custom fields and boxes on the Write/Edit page via POST and GET requests to the options-general.php endpoint.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Henrikmelin Wordpress

Products

More Fields Wordpress