SUSE CVE-2026-68469

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENTSLEEP -...

PT-2026-82050

Arbitrary file overwrite via SAVE PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

CVE-2026-18323 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-65314

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-81164

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em options save function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: State corruption has been prevented in fpurestoresig. The non-compacted slowpath uses copyfromuser to copy the entire user buffer into the kernel buffer, verbatim. This means that the kernel buffer may now contain entire...

CVE-2026-30865

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

EUVD-2026-64147

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30865 Combodo iTop: Reflected XSS in dashboard save

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30865 Combodo iTop: Reflected XSS in dashboard save

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30865 Combodo iTop: Reflected XSS in dashboard save

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30865

Combodo iTop , a web-based IT service management tool, is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality . The flaw allows an attacker to craft a malicious URL that, when clicked by a victim, executes arbitrary script in the victim's browser c...

CVE-2026-30865

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

EUVD-2026-63935

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780

Roskus Prospero Flow CRM versions 4.9.1 through 5.14.0 contain an authorization bypass (IDOR) in the POST /transaction/save endpoint. A user with transaction and accounting creation permissions can supply a bank_account_id or bank_card_id belonging to another company, and the value is persisted a...

CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780 Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...