rootpwn

medium · CVSS v3 5 · CVSS v4 5.6

CVE-2026-15953

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and contr…

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600). This issue affects Protection and control IED manager (PCM600): through 2.14.

Scores

Severity
medium
CVSS v2
4.6
CVSS v3
5
CVSS v4
5.6
EPSS
—

← All CVEs

Related CVEs

medium

CVE-2026-82546

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped Trackback, verification and moderation defaults allow the value to be approved and rendered as an active link; a visitor who clicks the link executes script in the weblog's origin. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes incoming Trackback support and suppresses non-HTTP(S) comment-author links. Users unable to upgrade should disable Trackbacks and remove untrusted Trackback comments.

View analysis

medium

CVE-2026-101035

A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library src/lib/nas/encode.cpp of the component nr-gnb. Executing a manipulation can lead to uncaught exception. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 1ae9bf2062b57595dbcbc4bc1d0a0ccf06815bac. It is best practice to apply a patch to resolve this issue.

View analysis

medium

CVE-2026-101006

CVE-2026-101006 is a medium severity flaw in Frappe HR up to 16.15.0 that allows remote attackers to manipulate the employee argument in certain API endpoints, leading to incorrect authorization. The vulnerability resides in the Permission Validation component of hrms/api/__init__.py and can enable unauthorized access to expense claims, shift requests, and attendance requests.

View analysis

medium

CVE-2026-84744

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

View analysis