Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers

A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by...

CVE-2026-91047

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not properly restrict access to protected WooCommerce product downloads, allowing unauthenticated users to bypass the payment requirement and retrieve any product's paid downloadable file...

CVE-2026-89286

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

CVE-2026-91046

The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin...

CVE-2026-94273

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment...

CVE-2026-16487

A flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS...

CVE-2026-76739

A potential security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server could be remotely exploited to list and modify RMC filesystem...

CVE-2026-112082

A vulnerability was identified in sgl-project SGLang up to 0.5.19. This impacts the function Scheduler.expertdistributionhandle of the file python/sglang/srt/eplb/expertdistribution.py of the component Expert-Distribution Recording Endpoint. Such manipulation leads to denial of service. It is...

CVE-2026-112083

A security flaw has been discovered in sgl-project SGLang up to 0.5.19. Affected is the function WeightExporter.sendweightstoremoteinstance of the file python/sglang/srt/modelexecutor/modelrunnercomponents/weightexporter.py of the component Weight Exporter. Performing a manipulation of the argume...

CVE-2026-112086

A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...

CVE-2026-108121

Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's SME Server version 11.0rc1-215, allowing an attacker with high privileges to inject reserved Apache configuration directives, corrupting httpd.conf and preventing Apache from...

CVE-2026-112081

A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlpcommon/hanlpcommon/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate...

CVE-2026-108120

Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the...

CVE-2026-106028

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons, allowing unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons...

CVE-2026-106933

The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in th...

CVE-2026-106014

The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler, allowing unauthenticated attackers to mark orders as paid without actually paying...

Exploit for CVE-2026-64560

CVE-2026-64560 binary corresponding source This repository is...

CVE-2026-112086 ESPnet Inference Model inference_model.py build_model deserialization

A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...

CVE-2026-112086

A vulnerability was found in ESPnet up to 202610.post2. This affects the function buildmodel of the file espnet3/publication/inferencemodel.py of the component Inference Model Handler. The manipulation of the argument target results in deserialization. It is possible to launch the attack remotely...

CVE-2026-94273 Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment...