rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-1969 ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload
The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file. This is due to an incorrect fix of CVE-2024-13448
Problem types: description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: trx_addons
default_status: unaffected
Credits: lang: en
value: Erwan LR (WPScan)
lang: en
value: WPScan
Published: 2026-03-23T06:00:04.026Z
CVE-2026-1970 Edimax BR-6258n formStaDrvSetup redirect
A flaw has been found in Edimax BR-6258n up to 1.18. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup. This manipulation of the argument submit-url causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The vendor confirms that the affected product is end-of-life. They confirm that they "will issue a consolidated Security Advisory on our official support website." This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-601
description: Open Redirect
Affected products: vendor: Edimax
product: BR-6258n
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: tian (VulDB User)
Published: 2026-02-05T22:02:07.174Z
CVE-2026-1971 Edimax BR-6288ACL wiz_WISP24gmanual.asp wiz_WISP24gmanual cross site scripting
A vulnerability has been found in Edimax BR-6288ACL up to 1.12. Impacted is the function wiz_WISP24gmanual of the file wiz_WISP24gmanual.asp. Such manipulation of the argument manualssid leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirms that the affected product is end-of-life. They confirm that they "will issue a consolidated Security Advisory on our official support website." This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: Edimax
product: BR-6288ACL
cpes: cpe:2.3:o:edimax:br-6288acl_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: tian (VulDB User)
Published: 2026-02-06T00:02:07.694Z
CVE-2026-1972 Edimax BR-6208AC auth_check_userpass2 default credentials
A vulnerability was found in Edimax BR-6208AC 2_1.02. The affected element is the function auth_check_userpass2. Performing a manipulation of the argument Username/Password results in use of default credentials. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor confirms that the affected product is end-of-life. They confirm that they "will issue a consolidated Security Advisory on our official support website." This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-1392
description: Use of Default Credentials
Affected products: vendor: Edimax
product: BR-6208AC
cpes: cpe:2.3:o:edimax:br-6208ac_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: tian (VulDB User)
Published: 2026-02-06T01:02:06.557Z
CVE-2026-1973 Free5GC SMF establishPfcpSession null pointer dereference
A vulnerability was determined in Free5GC up to 4.1.0. The impacted element is the function establishPfcpSession of the component SMF. Executing a manipulation can lead to null pointer dereference. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. It is best practice to apply a patch to resolve this issue.
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: Free5GC
cpes: cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: ZiyuLin (VulDB User)
Published: 2026-02-06T01:32:08.923Z
CVE-2026-1974 Free5GC SMF datapath.go ResolveNodeIdToIp denial of service
A vulnerability was identified in Free5GC up to 4.1.0. This affects the function ResolveNodeIdToIp of the file internal/sbi/processor/datapath.go of the component SMF. The manipulation leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: Free5GC
cpes: cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: ZiyuLin (VulDB User)
Published: 2026-02-06T02:02:10.925Z
CVE-2026-1975 Free5GC pfcp_reports.go identityTriggerType null pointer dereference
A security flaw has been discovered in Free5GC up to 4.1.0. This impacts the function identityTriggerType of the file pfcp_reports.go. The manipulation results in null pointer dereference. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Applying a patch is advised to resolve this issue.
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: Free5GC
cpes: cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: LinZiyu (VulDB User)
Published: 2026-02-06T02:32:10.390Z
CVE-2026-1976 Free5GC SMF SessionDeletionResponse null pointer dereference
A weakness has been identified in Free5GC up to 4.1.0. Affected is the function SessionDeletionResponse of the component SMF. This manipulation causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. It is suggested to install a patch to address this issue.
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: Free5GC
cpes: cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: LinZiyu (VulDB User)
Published: 2026-02-06T03:02:11.211Z
CVE-2026-1977 isaacwasserman mcp-vegalite-server visualize_data eval code injection
A security vulnerability has been detected in isaacwasserman mcp-vegalite-server up to 16aefed598b8cd897b78e99b907f6e2984572c61. Affected by this vulnerability is the function eval of the component visualize_data. Such manipulation of the argument vegalite_specification leads to code injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-94
description: Code Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: isaacwasserman
product: mcp-vegalite-server
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Lexpl0it (VulDB User)
Published: 2026-02-06T03:32:06.801Z
CVE-2026-1978 kalyan02 NanoCMS User Information pagesdata.txt direct request
A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request. It is possible to initiate the attack remotely. The exploit is now public and may be used. You should change the configuration settings.
Problem types: cwe_id: CWE-425
description: Direct Request
Affected products: vendor: kalyan02
product: NanoCMS
cpes: cpe:2.3:a:kalyan02:nanocms:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: g111 (VulDB User)
Published: 2026-02-06T04:02:07.172Z
CVE-2026-1979 mruby JMPNOT-to-JMPIF Optimization vm.c mrb_vm_exec use after free
A flaw has been found in mruby up to 3.4.0. This affects the function mrb_vm_exec of the file src/vm.c of the component JMPNOT-to-JMPIF Optimization. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been published and may be used. This patch is called e50f15c1c6e131fa7934355eb02b8173b13df415. It is advisable to implement a patch to correct this issue.
Problem types: cwe_id: CWE-416
description: Use After Free
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: n/a
product: mruby
cpes: cpe:2.3:a:mruby:mruby:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: Oneafter (VulDB User)
Published: 2026-02-06T04:32:09.200Z
CVE-2026-1980 WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
The WPBookit plugin for WordPress is vulnerable to unauthorized data disclosure due to a missing authorization check on the 'get_customer_list' route in all versions up to, and including, 1.0.8. This makes it possible for unauthenticated attackers to retrieve sensitive customer information including names, emails, phone numbers, dates of birth, and gender.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: iqonicdesign
product: WPBookit
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: MD. TAREQ AHAMED JONY
Published: 2026-03-04T01:21:58.871Z
CVE-2026-1981 Winston AI <= 0.0.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
The HUMN-1 AI Website Scanner & Human Certification by Winston AI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the winston_disconnect() function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset the plugin's API connection settings via the 'winston_disconnect' AJAX action.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: winstonai
product: HUMN-1 AI Website Scanner & Human Certification by Winston AI
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Abhirup Konwar
Published: 2026-03-06T23:22:59.774Z
CVE-2026-1983 SEATT: Simple Event Attendance <= 1.5.0 - Cross-Site Request Forgery to Arbitrary Event Deletion
The SEATT: Simple Event Attendance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing nonce validation on the event deletion functionality. This makes it possible for unauthenticated attackers to delete arbitrary events via a forged request granted they can trick an administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: sourcez
product: SEATT: Simple Event Attendance
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: MD. TAREQ AHAMED JONY
Published: 2026-02-14T04:35:42.467Z
CVE-2026-1985 Press3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block
The Press3D plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 3D Model Gutenberg block in all versions up to, and including, 1.0.2. This is due to the plugin failing to sanitize and validate the URL scheme when storing link URLs for 3D model blocks, allowing `javascript:` URLs. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages via the link URL parameter that will execute whenever a user clicks on the 3D model.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: arieslab
product: Press3D
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Athiwat Tiprasaharn
lang: en
value: Itthidej Aramsri
Published: 2026-02-14T06:42:35.710Z
CVE-2026-1986 FloristPress for Woo <= 7.8.2 - Reflected Cross-Site Scripting via 'noresults' Parameter
The FloristPress for Woo – Customize your eCommerce store for your Florist plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'noresults' parameter in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping on the user supplied 'noresults' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: bakkbone
product: FloristPress for Woo – Customize your eCommerce store for your Florist
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Athiwat Tiprasaharn
Published: 2026-03-26T02:25:20.549Z
CVE-2026-1987 Scheduler Widget <= 0.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Event Modification
The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.1.6. This is due to the `scheduler_widget_ajax_save_event()` function lacking proper authorization checks and ownership verification when updating events. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify any event in the scheduler via the `id` parameter granted they have knowledge of the event ID.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: morelmathieuj
product: Scheduler Widget
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: MD. TAREQ AHAMED JONY
Published: 2026-02-14T06:42:37.284Z
CVE-2026-1988 Flexi Product Slider and Grid for WooCommerce <= 1.0.5 - Authenticated (Contributor+) Local File Inclusion via 'theme' Shortcode Attribute
The Flexi Product Slider and Grid for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.5 via the `flexipsg_carousel` shortcode. This is due to the `theme` parameter being directly concatenated into a file path without proper sanitization or validation, allowing directory traversal. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server via the `theme` parameter granted they can create posts with shortcodes.
Problem types: cwe_id: CWE-98
description: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Affected products: vendor: wpdecent
product: Flexi Product Slider and Grid for WooCommerce
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: Muhammad Yudha - DJ
Published: 2026-02-14T06:42:37.658Z
CVE-2026-1990 oatpp Type.hpp ObjectWrapper null pointer dereference
A security vulnerability has been detected in oatpp up to 1.3.1. This impacts the function oatpp::data::type::ObjectWrapper::ObjectWrapper of the file src/oatpp/data/type/Type.hpp. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: oatpp
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Oneafter (VulDB User)
Published: 2026-02-06T05:02:08.766Z
CVE-2026-1991 libuvc UVC Descriptor device.c uvc_scan_streaming null pointer dereference
A vulnerability was detected in libuvc up to 0.0.7. Affected is the function uvc_scan_streaming of the file src/device.c of the component UVC Descriptor Handler. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: libuvc
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Oneafter (VulDB User)
Published: 2026-02-06T05:32:08.140Z
CVE-2026-1992 ExactMetrics 8.6.0 - 9.0.2 - Authenticated (Custom) Insecure Direct Object Reference to Arbitrary Plugin Installation
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 through 9.0.2. This is due to the `store_settings()` method in the `ExactMetrics_Onboarding` class accepting a user-supplied `triggered_by` parameter that is used instead of the current user's ID to check permissions. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to bypass the `install_plugins` capability check by specifying an administrator's user ID in the `triggered_by` parameter, allowing them to install arbitrary plugins and achieve Remote Code Execution. This vulnerability only affects sites on which administrator has given other user types the permission to view reports and can only be exploited by users of that type.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: smub
product: ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Ali Sünbül
Published: 2026-03-11T09:25:43.399Z
CVE-2026-1993 ExactMetrics 7.1.0 - 9.0.2 - Authenticated (Custom) Improper Privilege Management to Role Privilege Escalation via Settings Update
The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to modify any plugin setting, including the `save_settings` option that controls which user roles have access to plugin functionality. The admin intended to delegate configuration access to a trusted user, not enable that user to delegate access to everyone. By setting `save_settings` to include `subscriber`, an attacker can grant plugin administrative access to all subscribers on the site.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: smub
product: ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin)
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: Ali Sünbül
Published: 2026-03-11T09:25:42.207Z
CVE-2026-1994 s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover
The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: clavaque
product: s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Credits: lang: en
value: Alyudin Nafiie
Published: 2026-02-19T06:49:43.503Z
CVE-2026-1995 IDrive Cloud Backup Client for Windows contains a privilege escalation vulnerability
IDrive’s id_service.exe process runs with elevated privileges and regularly reads from several files under the C:\ProgramData\IDrive\ directory. The UTF16-LE encoded contents of these files are used as arguments for starting a process, but they can be edited by any standard user logged into the system. An attacker can overwrite or edit the files to specify a path to an arbitrary executable, which will then be executed by the id_service.exe process with SYSTEM privileges.
Problem types: description: CWE-269 Improper Privilege Management
Affected products: vendor: IDrive
product: IDrive Cloud Backup Client for Windows
Published: 2026-03-24T18:00:15.664Z
CVE-2026-1996 Certain HP OfficeJet Pro Printers – Denial of Service
Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection.
Problem types: cwe_id: CWE-703
description: CWE-703
Affected products: vendor: HP Inc
product: HP OfficeJet Pro 8710 All-in-One Printer series
default_status: unaffected
Published: 2026-02-10T17:34:18.409Z