Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-40884

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP authentication bypass when the documented empty-username basic-auth syntax is used. If the server is started with -b ':pass' together with -sftp, goshs accepts that configuration but does not install any SFTP password handler. As a result, an unauthenticated network attacker can connect to the SFTP service and access files without a password. This vulnerability is fixed in 2.0.0-beta.6.

PUBLISHED
Vendor
patrickhener
Product
goshs
Provider severity
CRITICAL
Conflicts
0

CVE-2026-40883

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because goshs relies on HTTP basic auth alone and performs no CSRF, Origin, or Referer validation for those routes. This vulnerability is fixed in 2.0.0-beta.6.

PUBLISHED
Vendor
patrickhener
Product
goshs
Provider severity
MEDIUM
Conflicts
0

CVE-2026-40882

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user who can call the import endpoint may trigger XML external entity processing, which can lead to server-side file disclosure and SSRF. The target file must be less than 1023 characters. Version 1.22.0 fixes the issue.

PUBLISHED
Vendor
openremote
Product
openremote
Provider severity
HIGH
Conflicts
0

CVE-2026-40881

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.0 and zebra-network version 5.0.1, when deserializing addr or addrv2 messages, which contain vectors of addresses, Zebra would fully deserialize them up to a maximum length (over 233,000) that was derived from the 2 MiB message size limit. This is much larger than the actual limit of 1,000 messages from the specification. Zebra would eventually check that limit but, at that point, the memory for the larger vector was alr

PUBLISHED
Vendor
ZcashFoundation, ZcashFoundation
Product
zebra-network, zebrad
Provider severity
MEDIUM
Conflicts
1

CVE-2026-40880

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and zebra-consensus version 5.0.2, a logic error in Zebra's transaction verification cache could allow a malicious miner to induce a consensus split. By carefully submitting a transaction that is valid for height H+1 but invalid for H+2 and then mining that transaction in a block at height H+2, a miner could cause vulnerable Zebra nodes to accept an invalid block, leading to a consensus split from the rest of the Zcash

PUBLISHED
Vendor
ZcashFoundation, ZcashFoundation
Product
zebra-consensus, zebrad
Provider severity
HIGH
Conflicts
1

CVE-2026-4088

The Switch CTA Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wppw_cta_box' shortcode in all versions up to, and including, 1.1. This is due to insufficient input sanitization and output escaping on user-supplied post meta values including 'cta_box_button_link', 'cta_box_button_id', 'cta_box_button_text', and 'cta_box_description'. The shortcode reads post meta from a user-specified post ID and echoes these values directly into HTML output without any escaping fun

PUBLISHED
Vendor
wpshouter
Product
Switch CTA Box
Provider severity
MEDIUM
Conflicts
0

CVE-2026-40879

Nest is a framework for building scalable Node.js server-side applications. Prior to 11.1.19, when an attacker sends many small, valid JSON messages in one TCP frame, handleData() recurses once per message; the buffer shrinks each call. maxBufferSize is never reached; call stack overflows instead. A ~47 KB payload is sufficient to trigger RangeError. This vulnerability is fixed in 11.1.19.

PUBLISHED
Vendor
nestjs
Product
nest
Provider severity
HIGH
Conflicts
0

CVE-2026-40878

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the mailcow web interface passes the raw `$_SERVER['REQUEST_URI']` to Twig as a global template variable and renders it inside a JavaScript string literal in the `setLang()` helper of `base.twig`, relying on Twig's default HTML auto-escaping instead of the context-appropriate `js` escaping strategy. In addition, the `query_string()` Twig helper merges all current `$_GET` parameters into th

PUBLISHED
Vendor
mailcow
Product
mailcow-dockerized
Provider severity
LOW
Conflicts
0

CVE-2026-40876

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs contains an SFTP root escape caused by prefix-based path validation. An authenticated SFTP user can read from and write to filesystem paths outside the configured SFTP root, which breaks the intended jail boundary and can expose or modify unrelated server files. The SFTP subsystem routes requests through sftpserver/sftpserver.go into DefaultHandler.GetHandler() in sftpserver/handler.go, which forwards file operations into re

PUBLISHED
Vendor
patrickhener
Product
goshs
Provider severity
HIGH
Conflicts
0

CVE-2026-40875

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the user dashboard's "Seen successful connections" (login history) renders the client IP from login logs without HTML escaping. Because the server trusts the X-Real-IP header as the source IP for logging, an attacker can inject HTML/JS into this field. This Self-XSS can be exploited by a Login CSRF to force the victim into the attacker's account, and then read emails in a previous browser

PUBLISHED
Vendor
mailcow
Product
mailcow-dockerized
Provider severity
HIGH
Conflicts
1

CVE-2026-40874

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with `/api/v1/delete/fwdhost`. Any authenticated user can call this API. Checks are only applied for edit/add actions, but deletion can still significantly disrupt the mail service. Version 2026-03b fixes the vulnerability.

PUBLISHED
Vendor
mailcow
Product
mailcow-dockerized
Provider severity
MEDIUM
Conflicts
0

CVE-2026-40873

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the Quarantine details modal injects attachment filenames into HTML without escaping, allowing arbitrary HTML/JS execution. An attacker can deliver an email with a crafted attachment name so that when an admin views the quarantine item, JavaScript executes in their browser, taking over their account. Version 2026-03b fixes the vulnerability.

PUBLISHED
Vendor
mailcow
Product
mailcow-dockerized
Provider severity
HIGH
Conflicts
1

CVE-2026-40872

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, the admin dashboard's Autodiscover logs render the EMailAddress value (logged as the "user" field) without HTML escaping. By submitting an unauthenticated Autodiscover request with a crafted EMailAddress containing HTML/JS, the payload is stored in Redis and executed when an admin views the Autodiscover logs. Version 2026-03b fixes the vulnerability.

PUBLISHED
Vendor
mailcow
Product
mailcow-dockerized
Provider severity
CRITICAL
Conflicts
1

CVE-2026-40871

mailcow: dockerized is an open source groupware/email suite based on docker. Versions prior to 2026-03b have a second-order SQL injection vulnerability in the quarantine_category field via the Mailcow API. The /api/v1/add/mailbox endpoint stores quarantine_category without validation or sanitization. This value is later used by quarantine_notify.py, which constructs SQL queries using unsafe % string formatting instead of parameterized queries. This results in a delayed (second-order) SQL injecti

PUBLISHED
Vendor
mailcow
Product
mailcow-dockerized
Provider severity
HIGH
Conflicts
1

CVE-2026-40870

Decidim is a participatory democracy framework. Starting in version 0.0.1 and prior to versions 0.30.5 and 0.31.1, the root level `commentable` field in the API allows access to all commentable resources within the platform, without any permission checks. All Decidim instances are impacted that have not secured the `/api` endpoint. The `/api` endpoint is publicly available with the default configuration. Versions 0.30.5 and 0.31.1 fix the issue. As a workaround, limit the scope to only authentic

PUBLISHED
Vendor
decidim
Product
decidim
Provider severity
HIGH
Conflicts
0

CVE-2026-4087

The Pre* Party Resource Hints plugin for WordPress is vulnerable to SQL Injection via the 'hint_ids' parameter of the pprh_update_hints AJAX action in all versions up to, and including, 1.8.20. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to e

PUBLISHED
Vendor
samperrow
Product
Pre* Party Resource Hints
Provider severity
MEDIUM
Conflicts
0

CVE-2026-40869

Decidim is a participatory democracy framework. Starting in version 0.19.0 and prior to versions 0.30.5 and 0.31.1, a vulnerability allows any registered and authenticated user to accept or reject any amendments. The impact is on any users who have created proposals where the amendments feature is enabled. This also elevates the user accepting the amendment as the author of the original proposal as people amending proposals are provided coauthorship on the coauthorable resources. Versions 0.30.5

PUBLISHED
Vendor
decidim
Product
decidim
Provider severity
HIGH
Conflicts
0

CVE-2026-40868

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. Because context.apiCall.service.url is policy-controlled, this can send the kyverno serviceaccount token to an attacker-controlled endpoint (confused deputy). Namespaced policies are blocked from servicecall

PUBLISHED
Vendor
kyverno
Product
kyverno
Provider severity
HIGH
Conflicts
0

CVE-2026-40867

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer allows any authenticated user to view attachments from other tickets by changing the attachment ID. This can expose sensitive support files and internal documents across unrelated users or teams.

PUBLISHED
Vendor
horilla-opensource
Product
horilla
Provider severity
HIGH
Conflicts
1

CVE-2026-40866

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoint allows any authenticated user to overwrite or replace or corrupt another employee’s document by changing the document ID in the upload request. This enables unauthorized modification of HR records.

PUBLISHED
Vendor
horilla-opensource
Product
horilla
Provider severity
HIGH
Conflicts
1

CVE-2026-40865

Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows any authenticated user to access other employees’ uploaded documents by changing the document ID in the request. This exposes sensitive HR files such as identity documents, contracts, certificates, and other private employee records.

PUBLISHED
Vendor
horilla-opensource
Product
horilla
Provider severity
HIGH
Conflicts
1

CVE-2026-40864

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affected, only HTTP form endpoints, such as /hub/spawn and /hub/accept-share, meaning attackers could trigger server spawn (but not access the server) and if the attacker is a JupyterHub user permitted to sha

PUBLISHED
Vendor
jupyterhub
Product
jupyterhub
Provider severity
MEDIUM
Conflicts
0

CVE-2026-40863

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the SpreadsheetML XML reader (Reader\Xml) does not validate the ss:Index row attribute against the maximum allowed row count (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a SpreadsheetML XML file with ss:Index="999999999" on a <Row> element, which inflates the internal cachedHighestRow to ~1 billion. Any subsequent call to getRowIterator() without an exp

PUBLISHED
Vendor
PHPOffice
Product
PhpSpreadsheet
Provider severity
HIGH
Conflicts
0

CVE-2026-40861

A Dag author could either (a) create a symlink under their task's log directory pointing to an arbitrary file readable by the API server process (read-path attack — e.g. `/etc/passwd` or `airflow.cfg`) or (b) supply a `task_id` containing `..` sequences accepted by the Task SDK's `KEY_REGEX` (write-path attack), and in both cases the FileTaskHandler resolves the log path outside the configured `base_log_folder`, leaking or overwriting arbitrary files. Only affects deployments where the worker lo

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Airflow
Provider severity
MEDIUM
Conflicts
0

CVE-2026-40860

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is reached whenever the mapJmsMessage option is enabled (the default) and Camel acts as a JMS consumer, an attacker able to publish a crafted ObjectMessage to a queue or topic consumed by a Camel applica

PUBLISHED
Vendor
Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Apache Software Foundation, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat Fuse 7, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Fuse 7, Red Hat Fuse 7, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Apache Camel, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat JBoss Enterprise Application Platform 8, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat JBoss Enterprise Application Platform 8
Provider severity
CRITICAL, HIGH
Conflicts
3

CVE-2026-4086

The WP Random Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cat', 'nocat', and 'text' shortcode attributes of the 'wp_random_button' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. Specifically, the random_button_html() function directly concatenates the 'cat' and 'nocat' parameters into HTML data-attributes without esc_attr(), and the 'text' paramete

PUBLISHED
Vendor
newbiesup
Product
WP Random Button
Provider severity
MEDIUM
Conflicts
0

CVE-2026-40859

Deserialization of Untrusted Data vulnerability in Apache Camel. The camel-vertx-http component deserializes HTTP response bodies carrying the Content-Type application/x-java-serialized-object using a raw java.io.ObjectInputStream, without applying any ObjectInputFilter (VertxHttpHelper.deserializeJavaObjectFromStream) This deserialization path is reached only when the producer endpoint is configured with transferException=true (or the component-level allowJavaSerializedObject=true) and throwEx

PUBLISHED
Vendor
Apache Software Foundation
Product
Apache Camel
Provider severity
HIGH
Conflicts
0

CVE-2026-40858

The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInputFilter. An attacker who can write to the Infinispan cache used by a Camel application can inject a crafted serialized Java object that, when read during normal aggregation repository operations such as get or recover, results in arbitrary code execution in the context of the application. This issue

PUBLISHED
Vendor
Red Hat, Red Hat, Apache Software Foundation, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Apache Camel, Red Hat Fuse 7, Red Hat Build of Apache Camel 4.18 for Quarkus 3.33, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform 8, Red Hat Fuse 7, Red Hat build of Apache Camel 4 for Quarkus 3
Provider severity
HIGH
Conflicts
2

CVE-2026-40852

A highly authenticated attacker can alter the config generator injecting a payload into future created configurations. The device is not correctly checking this configuration value before passing it to an system execute leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

PUBLISHED
Vendor
MB connect line, MB connect line, Helmholz, MB connect line, MB connect line, Helmholz, Helmholz, Helmholz
Product
mbNET/mbNET.rokey, mbNET.mini, REX200/250, mbNET.mini, mbNET/mbNET.rokey, REX200/250, REX100, REX100
Provider severity
HIGH
Conflicts
1

CVE-2026-40851

A local attacker can perform a confusion attack on the cfgparser via a specially crafted file on an USB stick leading to code execution. This can result in a total loss of confidentiality, integrity and availability.

PUBLISHED
Vendor
MB connect line, Helmholz, MB connect line, Helmholz, MB connect line, MB connect line, Helmholz, Helmholz
Product
mbNET.mini, REX100, mbNET.mini, REX200/250, mbNET/mbNET.rokey, mbNET/mbNET.rokey, REX100, REX200/250
Provider severity
HIGH
Conflicts
1

CVE-2026-40850

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
Helmholz, MB connect line, MB connect line, Helmholz, Helmholz, MB connect line, Helmholz, MB connect line
Product
myREX24V2.virtual, mbCONNECT24, mymbCONNECT24, myREX24V2.virtual, myREX24V2, mymbCONNECT24, myREX24V2, mbCONNECT24
Provider severity
HIGH
Conflicts
2

CVE-2026-4085

The Easy Social Photos Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper_class' shortcode attribute of the 'my-instagram-feed' shortcode in all versions up to, and including, 3.1.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. Specifically, the plugin uses sanitize_text_field() instead of esc_attr() when outputting the 'wrapper_class' attribute inside a double-quoted HTML class attribute. Since sanitize_t

PUBLISHED
Vendor
maltathemes
Product
Easy Social Photos Gallery – MIF
Provider severity
MEDIUM
Conflicts
0

CVE-2026-40849

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the user_alarmprofile view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
Helmholz, Helmholz, MB connect line, Helmholz, MB connect line, MB connect line, Helmholz, MB connect line
Product
myREX24V2, myREX24V2.virtual, mbCONNECT24, myREX24V2, mymbCONNECT24, mbCONNECT24, myREX24V2.virtual, mymbCONNECT24
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40848

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
MB connect line, Helmholz, Helmholz, MB connect line, MB connect line, Helmholz, Helmholz, MB connect line
Product
mbCONNECT24, myREX24V2.virtual, myREX24V2, mymbCONNECT24, mbCONNECT24, myREX24V2.virtual, myREX24V2, mymbCONNECT24
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40847

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system_tag view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
Helmholz, Helmholz, MB connect line, MB connect line, MB connect line, MB connect line, Helmholz, Helmholz
Product
myREX24V2, myREX24V2, mymbCONNECT24, mbCONNECT24, mbCONNECT24, mymbCONNECT24, myREX24V2.virtual, myREX24V2.virtual
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40846

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
Helmholz, Helmholz, MB connect line, Helmholz, MB connect line, MB connect line, MB connect line, Helmholz
Product
myREX24V2.virtual, myREX24V2, mymbCONNECT24, myREX24V2, mymbCONNECT24, mbCONNECT24, mbCONNECT24, myREX24V2.virtual
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40845

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the devices_configuration view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
Helmholz, MB connect line, Helmholz, MB connect line, Helmholz, MB connect line, Helmholz, MB connect line
Product
myREX24V2.virtual, mbCONNECT24, myREX24V2.virtual, mymbCONNECT24, myREX24V2, mbCONNECT24, myREX24V2, mymbCONNECT24
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40844

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
Helmholz, Helmholz, MB connect line, MB connect line, Helmholz, MB connect line, Helmholz, MB connect line
Product
myREX24V2.virtual, myREX24V2, mymbCONNECT24, mbCONNECT24, myREX24V2.virtual, mbCONNECT24, myREX24V2, mymbCONNECT24
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40843

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the alarming view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
Helmholz, Helmholz, MB connect line, MB connect line, MB connect line, Helmholz, MB connect line, Helmholz
Product
myREX24V2, myREX24V2, mbCONNECT24, mbCONNECT24, mymbCONNECT24, myREX24V2.virtual, mymbCONNECT24, myREX24V2.virtual
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40842

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getWidgetTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
MB connect line, Helmholz, MB connect line, MB connect line, Helmholz, Helmholz, Helmholz, MB connect line
Product
mymbCONNECT24, myREX24V2.virtual, mbCONNECT24, mbCONNECT24, myREX24V2, myREX24V2, myREX24V2.virtual, mymbCONNECT24
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40841

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectTags function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
Helmholz, Helmholz, Helmholz, MB connect line, Helmholz, MB connect line, MB connect line, MB connect line
Product
myREX24V2, myREX24V2.virtual, myREX24V2, mymbCONNECT24, myREX24V2.virtual, mbCONNECT24, mbCONNECT24, mymbCONNECT24
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40840

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the VerifyCreateLicences function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
MB connect line, Helmholz, MB connect line, Helmholz, Helmholz, MB connect line, MB connect line, Helmholz
Product
mbCONNECT24, myREX24V2, mbCONNECT24, myREX24V2.virtual, myREX24V2.virtual, mymbCONNECT24, mymbCONNECT24, myREX24V2
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-4084

The fyyd podcast shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fyyd-podcast', 'fyyd-episode', and 'fyyd' shortcodes in all versions up to, and including, 0.3.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'color', 'podcast_id', and 'podcast_slug'. These attributes are directly concatenated into inline JavaScript within single-quoted string arguments without any escaping or sanitization, a

PUBLISHED
Vendor
cbednarek
Product
fyyd podcast shortcodes
Provider severity
MEDIUM
Conflicts
0

CVE-2026-40839

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getComponentScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
Helmholz, Helmholz, MB connect line, MB connect line, MB connect line, Helmholz, Helmholz, MB connect line
Product
myREX24V2.virtual, myREX24V2, mymbCONNECT24, mbCONNECT24, mymbCONNECT24, myREX24V2, myREX24V2.virtual, mbCONNECT24
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40838

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getDeviceScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
MB connect line, MB connect line, Helmholz, Helmholz, Helmholz, MB connect line, Helmholz, MB connect line
Product
mbCONNECT24, mymbCONNECT24, myREX24V2, myREX24V2, myREX24V2.virtual, mbCONNECT24, myREX24V2.virtual, mymbCONNECT24
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40837

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getProjectScalings function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
Helmholz, MB connect line, MB connect line, Helmholz, MB connect line, Helmholz, Helmholz, MB connect line
Product
myREX24V2.virtual, mymbCONNECT24, mbCONNECT24, myREX24V2.virtual, mbCONNECT24, myREX24V2, myREX24V2, mymbCONNECT24
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40836

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the inmessage model due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

PUBLISHED
Vendor
MB connect line, Helmholz, Helmholz, MB connect line, MB connect line, MB connect line, Helmholz, Helmholz
Product
mymbCONNECT24, myREX24V2.virtual, myREX24V2.virtual, mbCONNECT24, mbCONNECT24, mymbCONNECT24, myREX24V2, myREX24V2
Provider severity
HIGH
Conflicts
2

CVE-2026-40835

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the saveObjectFromData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

PUBLISHED
Vendor
Helmholz, Helmholz, MB connect line, MB connect line, Helmholz, Helmholz, MB connect line, MB connect line
Product
myREX24V2.virtual, myREX24V2, mymbCONNECT24, mbCONNECT24, myREX24V2, myREX24V2.virtual, mymbCONNECT24, mbCONNECT24
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-40834

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash_layout.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

PUBLISHED
Vendor
Helmholz, MB connect line, MB connect line, Helmholz, MB connect line, Helmholz, Helmholz, MB connect line
Product
myREX24V2.virtual, mymbCONNECT24, mbCONNECT24, myREX24V2, mbCONNECT24, myREX24V2, myREX24V2.virtual, mymbCONNECT24
Provider severity
HIGH
Conflicts
2

CVE-2026-40833

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

PUBLISHED
Vendor
MB connect line, MB connect line, Helmholz, MB connect line, Helmholz, MB connect line, Helmholz, Helmholz
Product
mbCONNECT24, mymbCONNECT24, myREX24V2.virtual, mymbCONNECT24, myREX24V2, mbCONNECT24, myREX24V2, myREX24V2.virtual
Provider severity
HIGH
Conflicts
2