Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Vulnerability	Exploitation status	Fix	Provider	Affected product	Published	Severity

`CVE-2026-124440`Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass	Exploitation statusNot confirmed	FixYes	Providerkyverno	Affected productkyverno	Published11/08/2026	SeverityCritical
`CVE-2026-124439`Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowException	Exploitation statusNot confirmed	FixYes	Providerscriban	Affected productscriban
`CVE-2026-124438`Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access	Exploitation statusNot confirmed	FixYes	Providerscriban	Affected productscriban
`CVE-2026-124437`Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion	Exploitation statusNot confirmed	FixYes	Providerscriban	Affected productscriban
`CVE-2026-124436`OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resources	Exploitation statusNot confirmed	FixYes	Provideropenremote	Affected product
`CVE-2026-124435`OpenRemote before 1.32.2 Stored XSS via Manager Configuration Image Upload	Exploitation statusNot confirmed	FixYes	Provideropenremote	Affected productcore
`CVE-2026-124434`Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actions	Exploitation statusNot confirmed	FixYes	Providergetgrav	Affected productgrav
`CVE-2026-124433`phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupController	Exploitation statusNot confirmed	FixYes	Providerthorsten	Affected product
`CVE-2026-124432`phpMyFAQ before 4.1.11 and 4.2.0-beta.3 Account Enumeration via WebAuthn prepare-login	Exploitation statusNot confirmed	FixNo	Provider-	Affected product-	Published
`CVE-2026-124431`Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement	Exploitation statusNot confirmed	FixYes	Providercraftcms	Affected productcms
`CVE-2026-124430`Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oracle	Exploitation statusNot confirmed	FixYes	Providercraftcms	Affected productcms
`CVE-2026-124429`Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration	Exploitation statusNot confirmed	FixYes	Providercraftcms	Affected productcms
`CVE-2026-124428`Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svg	Exploitation statusNot confirmed	FixYes	Providercraftcms	Affected productcms
`CVE-2026-124427`Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next	Exploitation statusNot confirmed	FixYes	Providercraftcms	Affected productcms
`CVE-2026-124426`Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field	Exploitation statusNot confirmed	FixYes	Providercraftcms	Affected productcms
`CVE-2026-124425`Parse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save Response	Exploitation statusNot confirmed	FixYes	Providerparse-community
`CVE-2026-124424`WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.php	Exploitation statusNot confirmed	FixYes	ProviderWWBN	Affected product
`CVE-2026-124330`FlowCI flow-core-x LocalFileManager LocalFileManager.java remove path traversal	Exploitation statusActively exploited	FixNo	ProviderFlowCI	Affected productflow-core-x
`CVE-2026-124329`FlowCI flow-core-x FileHelper.java FileHelper.unzip path traversal	Exploitation statusActively exploited	FixNo	ProviderFlowCI	Affected productflow-core-x
`CVE-2026-124328`FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run code injection	Exploitation statusActively exploited	FixNo	ProviderFlowCI	Affected product
`CVE-2026-124326`DataLinkDC Dinky Catalogue Upload CatalogueController.java file.getOriginalFilename path traversal	Exploitation statusNot confirmed	FixNo	ProviderDataLinkDC	Affected product
`CVE-2026-110963`Userplace <= 1.2.0 - Unauthenticated Privilege Escalation	Exploitation statusActively exploited	FixNo	Provider-	Affected productUserplace
`CVE-2026-110132`Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and Modification	Exploitation statusActively exploited	FixYes	Provider-	Affected productSync Post With Other Site
`CVE-2026-109925`Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers	Exploitation statusActively exploited	FixYes	Provider-	Affected productProductive Commerce
`CVE-2026-106015`Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force	Exploitation statusActively exploited	FixNo	Provider-	Affected productEcommerce Affiliate
`CVE-2026-105970`BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation	Exploitation statusActively exploited	FixNo	Provider-	Affected productThanh Toán Quét Mã QR Code Tự Động
`CVE-2026-104639`Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook	Exploitation statusActively exploited	FixYes	Provider-	Affected productRazorpay for WooCommerce
`CVE-2026-104338`Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon Route	Exploitation statusActively exploited	FixYes	Provider-	Affected productRazorpay for WooCommerce
`CVE-2026-104337`Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon Apply	Exploitation statusActively exploited	FixYes	Provider-	Affected productRazorpay for WooCommerce
`CVE-2026-104307`BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_error	Exploitation statusActively exploited	FixYes	Provider-	Affected productBackUpWordPress
`CVE-2026-103303`Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background Setting	Exploitation statusActively exploited	FixNo	Provider-	Affected productTurisbook Booking System
`CVE-2026-114432`Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename	Exploitation statusActively exploited	FixYes	Provider-	Affected productContact Form 7
`CVE-2026-96963`Pie Register <= 3.8.4.15 - Contributor+ Invitation Code Modification	Exploitation statusActively exploited	FixNo	Provider-	Affected productPie Register
`CVE-2026-96961`Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data Destruction	Exploitation statusActively exploited	FixNo	Provider-	Affected productPie Register
`CVE-2026-103375`Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data Disclosure	Exploitation statusActively exploited	FixNo	Provider-	Affected productAntom Payments
`CVE-2026-97195`Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field Definition	Exploitation statusActively exploited	FixYes	Provider-	Affected productSecure Custom Fields
`CVE-2026-97194`Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational Fields	Exploitation statusActively exploited	FixYes	Provider-	Affected productSecure Custom Fields
`CVE-2026-97193`Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDOR	Exploitation statusActively exploited	FixYes	Provider-	Affected productSecure Custom Fields
`CVE-2026-97192`Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save Path	Exploitation statusActively exploited	FixYes	Provider-	Affected productSecure Custom Fields
`CVE-2026-85344`FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing Authorization	Exploitation statusActively exploited	FixYes	Provider-	Affected productFV Flowplayer Video Player
`CVE-2026-122085`Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII Disclosure	Exploitation statusActively exploited	FixYes	Provider-	Affected productEvent Tickets Manager for WooCommerce
`CVE-2026-122062`Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST API	Exploitation statusActively exploited	FixYes	Provider-	Affected productPronamic Pay
`CVE-2026-122060`WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe Disclosure	Exploitation statusActively exploited	FixYes	Provider-	Affected productWP Recipe Maker
`CVE-2026-114713`CVE-2026-114713	Exploitation statusNot confirmed	FixYes	ProviderUnrealIRCd	Affected productUnrealIRCd
`CVE-2026-124422`SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholder	Exploitation statusNot confirmed	FixYes	Providerjihong88	Affected productsuneditor
`CVE-2026-123616`imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loader	Exploitation statusNot confirmed	FixYes	Providerimgproxy	Affected productimgproxy
`CVE-2026-123615`imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loader	Exploitation statusNot confirmed	FixYes	Providerimgproxy	Affected productimgproxy
`CVE-2026-123614`imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow	Exploitation statusNot confirmed	FixYes	Providerimgproxy	Affected productimgproxy
`CVE-2026-123613`Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypass	Exploitation statusNot confirmed	FixYes	Providerrustls	Affected product
`CVE-2026-123612`rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosure	Exploitation statusNot confirmed	FixYes	Providerrustls	Affected product

421,264 Results | Page 4 of 8,426

Vulnerability Database

Vulnerabilities

Top 5 providers by vulnerabilities (90 days)

Run an in-depth assessment with complete web risk management

Explore more resources from CyStack

Website security reports

CyStack research

Filters

Cybersecurity knowledge