CVE-2026-86461

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the checkmimetype function. This is due to incomplete file type validation in the checkmimetype function — while some extension checking is...

CVE-2026-86461 FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the checkmimetype function. This is due to incomplete file type validation in the checkmimetype function — while some extension checking is...

CVE-2026-86461

The FV Flowplayer Video Player plugin for WordPress (versions

EUVD-2026-101496

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the checkmimetype function. This is due to incomplete file type validation in the checkmimetype function — while some extension checking is...

CVE-2026-86461 FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Arbitrary File Upload via 'video_url' Parameter

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 7.5.54.7212 via the checkmimetype function. This is due to incomplete file type validation in the checkmimetype function — while some extension checking is...

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center JC3 and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI aka NX or FA, Haozi aka Phoenix, and Iron Man System...

Red Hat Ansible Automation Platform Cross-site Scripting Vulnerability

The Red Hat Ansible Automation Platform UI versions 2.6 and 2.7 have a cross-site scripting vulnerability. This vulnerability stems from the formatPartURL function in the Hub collection module renderer, which does not restrict the URL protocol/scheme. As a result, a storage-type cross-site...

Game Music Emulators developers’ game-music-emu buffer error vulnerability

Developers of Game Music Emulators like game-music-emu 0.6.5 and earlier have a buffer error vulnerability. This vulnerability stems from integer underflow during the boundary check on the track-table in the AY loader’s getdata function. As a result, heap out-of-bounds reading occurs. Attackers c...

Sparx Systems Enterprise Architect: Input validation vulnerability

Sparx Systems Enterprise Architect version 17.1 has a vulnerability related to input validation. This vulnerability stems from XML External Entities XXE injections in the XSLT Debugger function. When users load special XML files that contain external DTD references, the parser processes these...

EasySoft Zentaopms Authorization Issue Vulnerability

EasySoft ZentaOPMS versions 22.6 and earlier have an authorization vulnerability. This vulnerability stems from an authorization bypass in the action::editComment function. Certified users can read and modify comments on products and projects that they do not have access to by providing any actio...

Nuxt Modules nuxt-og-image trust management issue vulnerability

Nuxt Modules’ nuxt-og-image version 6.2.5 to 6.7.0 contain a trust management issue. This vulnerability arises from the dynamic/og/d/.png routing mechanism accepting unsigned requests. Additionally, the resolvePathCacheKey function can derive cache keys from the request path, site URL, and...

Swami Project libinstpatch buffer error vulnerability

The Swami Project libinstpatch versions 1.1.7 and earlier contain a buffer error vulnerability. This vulnerability stems from the ipatchsf2genisvalid function in the SoundFont 2 loader, which does not perform a range check on the generator ID before the validity mask test. Attackers can exploit...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.13 Vulnerability Details CVEID:CVE-2026-45820 DESCRIPTION: fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring...

Security Bulletin: Platform Navigator in IBM Integration is vulnerable to multiple vulnerabilities in undici

Summary Platform Navigator in IBM Integration is vulnerable to multiple vulnerabilities in undici. CVE-2026-18149, CVE-2026-18540, CVE-2026-19534, CVE-2026-84890, CVE-2026-84933, CVE-2026-84947, CVE-2026-84961, CVE-2026-85008, CVE-2026-85014, CVE-2026-85024 The vulnerabilities have been addressed...

openjpeg-2.3.0_CVE-2020-27824

OPENJPEG Library and Applications What is OpenJPEG ? OpenJPEG is an open-source JPEG 2000 codec written in C language. It has been developed in order to promote the use of JPEG 2000, a still-image compression standard from the Joint Photographic Experts Group JPEG. Since April 2015, it is...

Security Bulletin:Vulnerabilities exists in IBM Netezza Appliance

Summary Vulnerabilities identified in the IBM Netezza Appliance have been remediated in the latest security patch release of NPS Vulnerability Details CVEID:CVE-2023-36464 DESCRIPTION: pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads t...

CVE-2026-39987-Marimo-Preauth-RCE

CVE-2026-39987 Marimo Pre-auth RCE Research Overview This project focuses on CVE-2026-39987, a pre-authentication Remote Code Execution vulnerability in Marimo related to the terminal WebSocket endpoint /terminal/ws. Marimo is an open-source reactive Python notebook that allows users to write and...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Struts

Summary Multiple vulnerabilities were addressed in IBM Library Support for Struts 1.0 Vulnerability Details CVEID:CVE-2005-3745 DESCRIPTION: Cross-site scripting XSS vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML vi...

Security Bulletin: IBM Guardium Data Protection is affected by a security vulnerability (CVE-2026-49844).

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This...

AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host

A flaw in Linux's vhost subsystem lets a local user read and write kernel memory at will and become root across nearly a decade of kernel versions. In one virtualization setup, it lets an untrusted virtual machine write to the host's memory and hijack the program that runs the virtual machine. Th...