Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Vulnerability	Exploitation status	Fix	Provider	Affected product	Published	Severity

`CVE-2026-121382`Netcore NBR100V2 auto_ac msg_aes_dec integer overflow	Exploitation statusNot exploited	FixNo	ProviderNetcore	Affected productNBR100V2	Published11/03/2026	SeverityHigh
`CVE-2026-46487`GeoNetwork: ACL bypass on Elasticsearch search when request body omits query field	Exploitation statusNot confirmed	FixYes	Providergeonetwork	Affected product
`CVE-2026-120955`MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata	Exploitation statusNot exploited	FixYes	ProviderMongoDB
`CVE-2026-121652`Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering	Exploitation statusNot exploited	FixYes	ProviderAWS	Affected product
`CVE-2026-120956`remote abort and memory disclosure from a malformed cursor.ns	Exploitation statusNot exploited	FixYes	ProviderMongoDB	Affected product
`CVE-2026-120684`MongoDB C Driver GridFS gap lets a shared writer recover a protected client's password	Exploitation statusNot exploited	FixYes	ProviderMongoDB	Affected product
`CVE-2026-120678`MongoDB C Driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)	Exploitation statusNot exploited	FixYes	ProviderMongoDB
`CVE-2026-63198`traQ: Privilege escalation by OAuth prompt=none request	Exploitation statusNot exploited	FixYes	ProvidertraPtitech	Affected producttraQ
`CVE-2026-82976`Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret	Exploitation statusNot confirmed	FixNo	ProviderRed Hat
`CVE-2026-120673`Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command	Exploitation statusNot exploited	FixYes	ProviderMongoDB	Affected product
`CVE-2026-63197`traQ: XSS in the User Uploaded File Retrieval API	Exploitation statusNot exploited	FixYes	ProvidertraPtitech	Affected producttraQ
`CVE-2026-63417`Logging Redactor: PII data in str/repr of non primitive objects was not being redacted	Exploitation statusNot confirmed	FixYes	Providerarmurox	Affected product
`CVE-2026-57154`OPNsense: Configuration line injection via multiple GUI text fields	Exploitation statusNot confirmed	FixYes	Provideropnsense	Affected product
`CVE-2026-119922`Babelfish for PostgreSQL Privilege Escalation	Exploitation statusNot exploited	FixYes	ProviderAWS	Affected productbabelfish-for-postgresql
`CVE-2026-63418`Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binary	Exploitation statusNot exploited	FixYes	Providermonitoring-plugins	Affected product
`CVE-2026-63499`zt-zip: ZipUtil.unpack can change file permissions of output directory	Exploitation statusActively exploited	FixYes	Providerzeroturnaround	Affected productzt-zip
`CVE-2026-63436`zt-zip: Path traversal in fluent API unpack	Exploitation statusNot confirmed	FixYes	Providerzeroturnaround	Affected productzt-zip
`CVE-2026-44267`Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter	Exploitation statusNot confirmed	FixYes	Providerenspirit	Affected product
`CVE-2026-44266`Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels	Exploitation statusActively exploited	FixYes	Providerenspirit
`CVE-2026-116845`NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView	Exploitation statusActively exploited	FixYes	Providernetbox-community	Affected product
`CVE-2026-44265`Elo: Code injection in Elo backends via unvalidated emission of programmatic AST fields	Exploitation statusNot confirmed	FixYes	Providerenspirit	Affected product
`CVE-2026-121263`phpMyAdmin MoTranslator Loader.php getTranslator path traversal	Exploitation statusActively exploited	FixNo	ProviderphpMyAdmin	Affected product
`CVE-2026-121628`Bagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting	Exploitation statusActively exploited	FixYes	Providerbagisto	Affected product
`CVE-2026-121627`buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL	Exploitation statusNot confirmed	FixYes	Providerjarun	Affected productbuku
`CVE-2026-121626`GNU Gatekeeper before 5.16 Out-of-Bounds Read in H.460.24 RTCP Probe Handler	Exploitation statusNot confirmed	FixYes	Providerwillamowius	Affected productgnugk
`CVE-2026-121625`GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing	Exploitation statusNot exploited	FixYes	Providerwillamowius	Affected productgnugk
`CVE-2026-121624`Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation	Exploitation statusNot exploited	FixYes	ProviderNanosystems	Affected productSupremo
`CVE-2026-121631`Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints	Exploitation statusNot confirmed	FixYes	Providerlightdash	Affected product
`CVE-2026-119509`WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	Providereranfl	Affected product
`CVE-2026-97072`WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProvidermyCred	Affected productmyCred
`CVE-2026-114187`WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderWPVibes	Affected productAnyWhere Elementor
`CVE-2026-121262`phpMyAdmin SQL-Parser ExplainStatement.php parse type conversion	Exploitation statusActively exploited	FixNo	ProviderphpMyAdmin	Affected product
`CVE-2026-103077`WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProvidermyCred	Affected productmyCred
`CVE-2026-114185`WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderWPVibes	Affected product
`CVE-2026-119485`WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability	Exploitation statusNot confirmed	FixYes	ProviderweDevs	Affected product
`CVE-2026-39777`WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability	Exploitation statusNot confirmed	FixYes	ProviderWC Lovers	Affected productWCFM Membership
`CVE-2026-119487`WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderweDevs	Affected product
`CVE-2026-120843`WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot confirmed	FixYes	ProviderBarn2 Plugins	Affected product
`CVE-2026-114183`WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability	Exploitation statusNot confirmed	FixYes	ProviderWPVibes	Affected product
`CVE-2026-116859`WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderWPMU DEV	Affected product
`CVE-2026-116858`WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability	Exploitation statusNot exploited	FixYes	ProviderWPMU DEV	Affected product
`CVE-2026-39743`WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderWC Lovers	Affected productWCFM Membership
`CVE-2026-120846`WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerability	Exploitation statusNot confirmed	FixYes	ProviderUncanny Owl	Affected product
`CVE-2026-115714`Improper Certificate Validation in Elastic Docker Images Leading to Interception of TLS Connections	Exploitation statusNot exploited	FixYes	ProviderElastic	Affected product
`CVE-2026-115716`Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service	Exploitation statusNot exploited	FixYes	ProviderElastic	Affected product
`CVE-2026-115715`Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service	Exploitation statusNot exploited	FixYes	ProviderElastic	Affected product
`CVE-2026-115710`Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure	Exploitation statusNot exploited	FixYes	ProviderElastic	Affected product
`CVE-2026-115298`Incorrect Authorization in Elasticsearch Leading to Information Disclosure	Exploitation statusNot exploited	FixYes	ProviderElastic	Affected product
`CVE-2026-115297`NULL Pointer Dereference in Packetbeat Leading to Denial of Service	Exploitation statusNot exploited	FixYes	ProviderElastic	Affected product
`CVE-2026-115295`Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure	Exploitation statusNot exploited	FixYes	ProviderElastic	Affected product

421,278 Results | Page 17 of 8,426

Vulnerability Database

Vulnerabilities

Top 5 providers by vulnerabilities (90 days)

Run an in-depth assessment with complete web risk management

Explore more resources from CyStack

Website security reports

CyStack research

Filters

Cybersecurity knowledge