Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

Vulnerability	Exploitation status	Fix	Provider	Affected product	Published	Severity

`CVE-2026-111036`Multiple vulnerabilities in Coupa’s Total Spend Management Platform	Exploitation statusNot confirmed	FixYes	ProviderCoupa	Affected productCoupa Total Spend Management Platform	Published11/04/2026	SeverityHigh
`CVE-2026-115498`Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field	Exploitation statusNot exploited	FixYes	Providerwingerspeed	Affected product
`CVE-2026-120554`Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save	Exploitation statusNot exploited	FixYes	Providercarazo	Affected product
`CVE-2026-93900`Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes	Exploitation statusNot exploited	FixYes	Providerelliotvs	Affected product
`CVE-2026-110935`Path traversal in plug-in deployment	Exploitation statusNot exploited	FixYes	ProviderPhoenix Contact	Affected product
`CVE-2026-110022`Signed plug-in validation bypass	Exploitation statusNot exploited	FixYes	ProviderPhoenix Contact	Affected productPLCnext Engineer
`CVE-2026-110021`Missing GSDX SignatureValue verification	Exploitation statusNot exploited	FixYes	ProviderPhoenix Contact	Affected product
`CVE-2026-95649`IRISPowerscan Insufficient restriction of untrusted scripts allows arbitrary code execution	Exploitation statusNot confirmed	FixYes	ProviderI.R.I.S S.A.	Affected product
`CVE-2026-94460`IRISPowerscan Insecure default privilege assignment for installation account	Exploitation statusNot confirmed	FixYes	ProviderI.R.I.S S.A.	Affected productIRISPowerscan
`CVE-2026-94459`IRISPowerscan Default accounts with predictable credentials	Exploitation statusNot confirmed	FixYes	ProviderI.R.I.S S.A.	Affected productIRISPowerscan
`CVE-2026-114421`Empty initial password permits GINA account takeover	Exploitation statusNot confirmed	FixYes	ProviderSEPPmail AG	Affected product
`CVE-2026-114420`LDAP wildcard injection exposes GINA recipient accounts	Exploitation statusNot confirmed	FixYes	ProviderSEPPmail AG	Affected product
`CVE-2026-114426`Pre-authentication upload parsing permits resource exhaustion	Exploitation statusNot confirmed	FixYes	ProviderSEPPmail AG	Affected product
`CVE-2026-114425`Forged LFT metadata permits arbitrary file read and deletion	Exploitation statusNot confirmed	FixYes	ProviderSEPPmail AG	Affected product
`CVE-2026-114424`Code execution through double evaluation in address replacement rules	Exploitation statusNot confirmed	FixYes	ProviderSEPPmail AG	Affected product
`CVE-2026-19731`Path Traversal in TÜBİTAK BİLGEM's İmzager	Exploitation statusNot confirmed	FixYes	ProviderTÜBİTAK BİLGEM Software Technologies Research Institute
`CVE-2026-19721`XXE in TÜBİTAK BİLGEM's İmzager	Exploitation statusNot confirmed	FixYes	ProviderTÜBİTAK BİLGEM Software Technologies Research Institute
`CVE-2026-57666`WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderAguila Technologies	Affected product
`CVE-2026-119366`WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderAdvancedCoding	Affected product
`CVE-2026-62007`WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderUnlimited Elements
`CVE-2026-54861`WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderAguila Technologies	Affected product
`CVE-2026-62126`WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability	Exploitation statusNot exploited	FixYes	ProviderminiOrange	Affected product
`CVE-2026-57775`WordPress Simple Cloudflare Turnstile plugin <= 1.44.1 - Broken Authentication vulnerability	Exploitation statusNot exploited	FixYes	ProviderRelyWP	Affected product
`CVE-2026-57639`WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderRoland Murg	Affected product
`CVE-2026-119477`WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderJacob N. Breetvelt	Affected product
`CVE-2026-56065`WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability	Exploitation statusNot exploited	FixYes	ProviderDoofinder	Affected product
`CVE-2026-110944`Resource exhaustion vulnerability in HTTP request handling impacts Qt HTTP Server (QHttpServer)	Exploitation statusNot confirmed	FixYes	Providerqt	Affected product
`CVE-2026-54851`WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability	Exploitation statusNot exploited	FixYes	ProviderAwesomemotive	Affected product
`CVE-2026-62000`WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability	Exploitation statusNot exploited	FixYes	ProviderWC Lovers	Affected productWCFM Marketplace
`CVE-2026-121818`About Time Technologies｜Herowatch Go - Security Misconfiguration	Exploitation statusNot exploited	FixYes	ProviderAbout Time Technologies	Affected productHerowatch Go
`CVE-2026-121817`About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference	Exploitation statusNot exploited	FixYes	ProviderAbout Time Technologies	Affected product
`CVE-2026-121816`About Time Technologies｜Herowatch Mini - Missing Authentication	Exploitation statusNot exploited	FixYes	ProviderAbout Time Technologies	Affected productHerowatch Mini
`CVE-2026-87044`Memory leak in the Mbed TLS crypto shim on failed cipher/AEAD operations leads to remotely triggered crypto denial of service	Exploitation statusNot confirmed	FixYes	Providerzephyrproject
`CVE-2026-87043`sys_rand_get() silently returns an unwritten buffer when the entropy device is not ready	Exploitation statusNot confirmed	FixYes	Providerzephyrproject	Affected product
`CVE-2026-87041`Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory	Exploitation statusNot confirmed	FixYes	Providerzephyrproject
`CVE-2026-87040`Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write	Exploitation statusNot confirmed	FixYes	Providerzephyrproject
`CVE-2026-87039`I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers	Exploitation statusNot confirmed	FixYes	Providerzephyrproject
`CVE-2026-87038`Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode	Exploitation statusNot confirmed	FixYes	Providerzephyrproject
`CVE-2026-16511`Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory	Exploitation statusNot confirmed	FixYes	Providerzephyrproject
`CVE-2026-85036`Bluetooth Classic AVDTP session reuse re-initializes a queued work item, corrupting the system work queue	Exploitation statusNot confirmed	FixYes	Providerzephyrproject
`CVE-2026-118983`VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks	Exploitation statusActively exploited	FixYes	Provider-	Affected productVikWidgetsLoader
`CVE-2026-118783`All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute	Exploitation statusActively exploited	FixYes	Provider-	Affected productAll-in-One Video Gallery
`CVE-2026-118637`Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode	Exploitation statusActively exploited	FixYes	Provider-	Affected productSimple Download Monitor
`CVE-2026-118523`EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override	Exploitation statusActively exploited	FixYes	Provider-	Affected productEventPrime
`CVE-2026-118422`Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path	Exploitation statusActively exploited	FixYes	Provider-	Affected productStape Conversion Tracking
`CVE-2026-118407`Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover	Exploitation statusActively exploited	FixYes	Provider-	Affected productPremium Packages
`CVE-2026-118404`Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR	Exploitation statusActively exploited	FixYes	Provider-	Affected productPremium Packages
`CVE-2026-118403`Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure	Exploitation statusActively exploited	FixYes	Provider-	Affected productPremium Packages
`CVE-2026-115426`WPvivid Backup & Migration < 0.9.138 - Admin+ Path Traversal via Local Backup Directory Setting	Exploitation statusActively exploited	FixYes	Provider-	Affected productWPvivid — Backup, Migration & Staging
`CVE-2026-115262`Duplicator < 5.1.0 - Subscriber+ SQLi via Charset and Collation Rewriter During Restore	Exploitation statusActively exploited	FixYes	Provider-	Affected productDuplicator

421,264 Results | Page 9 of 8,426

Vulnerability Database

Vulnerabilities

Top 5 providers by vulnerabilities (90 days)

Run an in-depth assessment with complete web risk management

Explore more resources from CyStack

Website security reports

CyStack research

Filters

Cybersecurity knowledge