CISA: Logging Reference Architecture

The Cybersecurity and Infrastructure Security Agency CISA developed the Logging Reference Architecture LRA in alignment with Office of Management and Budget Memorandum M-26-14: Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, which w...

CVE-2026-75142

FFmpeg before commit 9d786e4 contains a stack buffer overflow in the MPEG-PS muxer libavformat/mpegenc.c. When muxing input with more streams than the muxer's fixed-size stack buffer accommodates, the buffer is overflowed. A crafted input with an excessive number of streams triggers the overflow...

CVE-2026-18372

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

CVE-2026-18371

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

CVE-2026-18372 CSS injection in M-Files Web

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

CVE-2026-18372

M-Files Web before version 26.8.16330.2 is affected by a CSS injection vulnerability. An authenticated vault administrator can inject arbitrary CSS into the web user interface displayed to other vault users, resulting in low integrity impact on both the vulnerable and subsequent systems. The CVSS...

EUVD-2026-62370

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

CVE-2026-18371 HTML injection in M-Files Web

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

CVE-2026-18371

An authenticated attacker in M-Files Web before version 26.8.16330.2 can inject HTML to alter UI contents shown to other users, enabling potential phishing or content spoofing. CVSS 4.0 rates it MEDIUM (5.1) with low privileges required and passive user interaction. No exploitation evidence is re...

EUVD-2026-62369

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

CVE-2026-18372: Improper Neutralization of Input During Web Page Generation

CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users...

PT-2026-78326

Name of the Vulnerable Software and Affected Versions M-Files Web versions prior to 26.8.16330.2 Description An authenticated vault administrator can inject arbitrary CSS into the web user interface. This allows the administrator to modify the visual presentation of the interface as displayed to...

CVE-2026-18371: Improper Neutralization of Input During Web Page Generation

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

PT-2026-78325

Name of the Vulnerable Software and Affected Versions M-Files Web versions prior to 26.8.16330.2 Description An authenticated attacker can perform HTML injection to modify the web user interface contents displayed to other users. Recommendations Update to version 26.8.16330.2...

EUVD-2026-60269

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in oncmdsocknotifyev drivers/modem/vendorstandalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via netbuflinearize, which caps the copy at 39 bytes and returns outlen = 39. The two...

PT-2026-76710

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in on cmd socknotifyev drivers/modem/vendor standalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via net buf linearize, which caps the copy at 39 bytes and returns out len = 39. The two...

DSPrompt: Dynamic Soft Prompt Defense against M-RAG Corruption

Multimodal Retrieval Augmented Generation M-RAG is increasingly vulnerable to adversarial attacks where malicious data are crafted to produce embeddings that align with benign entries in the vector space, deceiving retrieval and inducing harmful outputs. Existing defenses primarily operate at que...

CVE-2026-12519: Out-of-bounds Write

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV: events in oncmdsocknotifyev drivers/modem/vendorstandalone/wncm14a2a.c. The response line is linearized into a fixed 40-byte stack buffer via netbuflinearize, which caps the copy at 39 bytes and returns outlen = 39. The two...

JLSEC-2026-1272

gf2n.cpp in Crypto++ aka cryptopp through 8.9.0 allows attackers to cause a denial of service application crash via DER public-key data for an F2^m curve, if the degree of each term in the polynomial is not strictly decreasing...

PT-2026-80514

gf2n.cpp in Crypto++ aka cryptopp through 8.9.0 allows attackers to cause a denial of service application crash via DER public-key data for an F2^m curve, if the degree of each term in the polynomial is not strictly decreasing...