Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Vulnerability	Exploitation status	Fix	Provider	Affected product	Published	Severity

`CVE-2026-99279`ksmbd: reclaim ended sessions on logoff and expiration	Exploitation statusNot confirmed	FixYes	ProviderLinux	Affected productLinux	Published11/07/2026	SeverityUnknown
`CVE-2026-99278`ksmbd: limit sessions on each connection	Exploitation statusNot confirmed	FixYes	ProviderLinux	Affected productLinux
`CVE-2026-99277`ksmbd: hold a connection reference for each session channel	Exploitation statusNot confirmed	FixYes	ProviderLinux	Affected product
`CVE-2026-99276`ksmbd: defer connection scavenging while session locks are busy	Exploitation statusNot confirmed	FixYes	ProviderLinux	Affected product
`CVE-2026-99275`smb: client: reject short SESSION_SETUP responses	Exploitation statusNot confirmed	FixYes	ProviderLinux	Affected productLinux
`CVE-2026-99274`smb: client: fix fiemap wild read on empty truncated response	Exploitation statusNot confirmed	FixYes	ProviderLinux	Affected product
`CVE-2026-99273`ksmbd: reserve space for the UTF-16 terminator in stream info	Exploitation statusNot confirmed	FixYes	ProviderLinux	Affected product
`CVE-2026-99272`smb: client: validate the data area in SMB2_read()	Exploitation statusNot confirmed	FixYes	ProviderLinux	Affected productLinux
`CVE-2026-99271`ALSA: line6: Clear prev_fbuf on capture buffer release	Exploitation statusNot confirmed	FixYes	ProviderLinux	Affected productLinux
`CVE-2026-123988`SililaWijesinghe Food Ordering System admin exposure of information through directory listing	Exploitation statusActively exploited	FixNo	ProviderSililaWijesinghe
`CVE-2026-123966`Tenda AC19 saveParentControlInfo heap-based overflow	Exploitation statusActively exploited	FixNo	ProviderTenda	Affected productAC19
`CVE-2026-120984`Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import	Exploitation statusNot confirmed	FixNo	ProviderRed Hat
`CVE-2026-123860`WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability	Exploitation statusNot exploited	FixYes	ProviderCrocoblock	Affected product
`CVE-2026-123964`OpenBMB Internet of Agents Collaboration Layer communication_layer.py launch_goal infinite loop	Exploitation statusActively exploited	FixNo	ProviderOpenBMB	Affected product
`CVE-2026-123861`WordPress JetFormBuilder – Hierarchical Select plugin <= 1.0.10 - Insecure Direct Object References (IDOR) vulnerability	Exploitation statusNot exploited	FixYes	ProviderCrocoblock
`CVE-2026-120839`WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability	Exploitation statusNot exploited	FixYes	ProviderMagepeople inc.	Affected productWpTravelly
`CVE-2026-120841`WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability	Exploitation statusNot exploited	FixYes	ProviderMagepeople inc.	Affected productWpTravelly
`CVE-2026-121777`WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability	Exploitation statusNot confirmed	FixYes	ProviderCool Plugins	Affected productCool Formkit Lite
`CVE-2026-123467`WordPress Motors plugin <= 1.4.128 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderStylemixThemes	Affected product
`CVE-2026-122659`WordPress Fluent Booking plugin <= 2.5.0 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderWP ManageNinja LLC	Affected product
`CVE-2026-121579`WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderUnlimited Elements
`CVE-2026-121575`WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderWP User Manager	Affected product
`CVE-2026-122660`WordPress FloristPress plugin <= 7.8.5 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderBAKKBONE Australia	Affected product
`CVE-2026-123483`WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability	Exploitation statusNot confirmed	FixYes	ProviderCrocoblock	Affected product
`CVE-2026-123183`WordPress Active Products Tables for WooCommerce plugin <= 2.1.6 - Content Injection vulnerability	Exploitation statusNot confirmed	FixYes	ProviderPluginUs.Net	Affected product
`CVE-2026-123474`WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.18 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderLeapWorx	Affected product
`CVE-2026-121775`WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderVillaTheme	Affected product
`CVE-2026-123462`WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProvidermyCred	Affected productmyCred
`CVE-2026-122669`WordPress Everest Forms plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderEverest Forms	Affected product
`CVE-2026-122663`WordPress CURCY plugin <= 2.2.20 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderVillaTheme	Affected product
`CVE-2026-121784`WordPress WpBookingly plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderMagepeople inc.	Affected product
`CVE-2026-123477`WordPress JetEngine plugin <= 3.9.0.2 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderCrocoblock	Affected product
`CVE-2026-123963`OpenBMB Internet of Agents Agent Registry app.py register missing authentication	Exploitation statusActively exploited	FixNo	ProviderOpenBMB	Affected productInternet of Agents
`CVE-2026-120579`Active Woot Products Tables for WooCommerce. 100% FREE <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'help_title' Shortcode Attribute	Exploitation statusNot exploited	FixYes	Providerrealmag777
`CVE-2026-109973`Flipbox <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'flip-box-image-upload-url-01-alt' Parameter	Exploitation statusNot exploited	FixYes	Provideroxilab	Affected product
`CVE-2026-122041`Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action	Exploitation statusNot exploited	FixYes	ProviderThemehigh
`CVE-2026-119156`Download Manager <= 7.5.9 - Unauthenticated Stored Cross-Site Scripting via Registration Form (WP_Error-as-ID) via Spotlight Template [author_name]	Exploitation statusNot exploited	FixYes	Providercodename065
`CVE-2026-119498`WordPress Simple Cloudflare Turnstile plugin <= 1.44.4 - Broken Authentication vulnerability	Exploitation statusNot exploited	FixYes	ProviderRelyWP	Affected product
`CVE-2026-121765`WordPress TranslatePress plugin <= 3.3.8 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderCozmoslabs	Affected product
`CVE-2026-123776`RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process	Exploitation statusNot confirmed	FixYes	Provider-	Affected productRRD-CGI-Image
`CVE-2026-93429`VikBooking Hotel Booking Engine & PMS <= 1.8.17 - Unauthenticated Stored Cross-Site Scripting via 'guests[][][documents]' Parameter	Exploitation statusNot exploited	FixYes	Providere4jvikwp	Affected product
`CVE-2026-121977`JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property	Exploitation statusNot exploited	FixYes	Providerjetmonsters	Affected product
`CVE-2026-120509`Real Testimonials <= 4.1.0 - Unauthenticated Stored Cross-Site Scripting via 'tpro_client_name' Parameter	Exploitation statusNot exploited	FixYes	Providershapedplugin	Affected product
`CVE-2026-115548`Quttera ThreatSign <= 4.1.0.48 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header	Exploitation statusNot exploited	FixYes	Providerquttera	Affected product
`CVE-2026-111317`JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source	Exploitation statusNot exploited	FixYes	Providerjetmonsters	Affected product
`CVE-2026-109214`User Frontend <= 4.3.13 - Unauthenticated Stored Cross-Site Scripting via Taxonomy Field Text-Input	Exploitation statusNot exploited	FixYes	Providerwedevs	Affected product
`CVE-2026-111370`WP Visitor Statistics (Real Time Traffic) <= 8.9.0 - Unauthenticated Stored Cross-Site Scripting via 'os' / 'browser' / 'res' Tracker Parameters	Exploitation statusNot exploited	FixYes	Providerosamaesh
`CVE-2026-109991`FunnelKit Payment Gateway for Stripe WooCommerce <= 1.15.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via 'order-pay' URL Path Parameter	Exploitation statusNot exploited	FixYes	Providerteamfunnelkit
`CVE-2026-104014`Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization	Exploitation statusNot exploited	FixYes	Providernaimurrahmannahid
`CVE-2026-118050`Football Pool <= 2.13.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shoutbox Message	Exploitation statusNot exploited	FixYes	ProviderAntoineH	Affected product

421,264 Results | Page 8 of 8,426

Vulnerability Database

Vulnerabilities

Top 5 providers by vulnerabilities (90 days)

Run an in-depth assessment with complete web risk management

Explore more resources from CyStack

Website security reports

CyStack research

Filters

Cybersecurity knowledge