EUVD-2026-46053

The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page. Unescaped output + unsanitised SVG...

CVE-2026-63852

A flaw was found in the Linux kernel's AMD GPU Graphics Processing Unit Video Core Next VCN component. This vulnerability arises because the VCN encoder and decoder rings do not properly handle 64-bit user fence writes, leading to the rejection of command submissions that utilize these fences. An...

CVE-2022-35497

creationtimestamp| type| source ---|---|--- 2026-07-20 18:00:06+00:00| seen| Telegram/zF5Spud96hIRv-kMH4Dj2nymZKpXTrW05uWfMwEMnMJUmrg 2026-07-21 00:00:33+00:00| seen| Telegram/zF5Spud96hIRv-kMH4Dj2nymZKpXTrW05uWfMwEMnMJUmrg 2026-07-22 00:00:06+00:00| published-proof-of-concept|...

CVE-2026-63849

A flaw was found in the Linux kernel's AMD GPU Graphics Processing Unit Video Core Next VCN component. This vulnerability arises because the VCN encoder and decoder rings do not properly support 64-bit user fence writes. A local attacker could potentially exploit this by submitting command stream...

CVE-2026-63845

A flaw was found in the Linux kernel, specifically within the AMD GPU's JPEG Joint Photographic Experts Group ring component. This vulnerability occurs because the JPEG v4.0 rings do not support 64-bit user fence writes. This can lead to the system rejecting command submissions that utilize user...

EUVD-2026-46049

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...

CVE-2026-44228

RT: Stored Cross-Site Scripting in versions 6.0.0–6.0.2 due to insufficient HTML escaping; an authenticated user with data‑setting permissions can inject JavaScript executed by other RT users. Fixed in 6.0.3. Affected product details, root cause, and fix are documented across CVE and NVD entries;...

CVE-2026-44228

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...

CVE-2026-44228 RT: Stored Cross-Site Scripting via insufficient template escaping

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3, contain a stored Cross-Site Scripting XSS vulnerability, where user-controlled data is rendered without proper HTML escaping. An authenticated user with permission to set the relevan...

CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

CVE-2026-63841

A flaw was found in the Linux kernel's amdgpu graphics driver, specifically within the JPEG component. This vulnerability occurs because the JPEG rings do not correctly support 64-bit user fence writes. A local attacker could exploit this by submitting command requests with 64-bit user fences,...

CVE-2026-63826

A flaw was found in the Linux kernel's framebuffer device fbdev component. When the storemodes function replaces a framebuffer's list of display modes, it fails to properly clear old pointers before freeing the old list. This can result in a use-after-free vulnerability, a type of memory...

CVE-2026-32819

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses...

CVE-2026-46715

Summary of CVE-2026-46715 (Flask-Security-Too) Affected: Flask-Security-Too up to version 5.8.0. Issue: in the OAuth reauthentication flow, the verification callback can mark a victim’s session as freshly reauthenticated after an OAuth identity belonging to a different user is verified. If an att...

CVE-2026-46715 Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim...

CVE-2026-46715 Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim...

CVE-2026-46715 Flask-Security-Too OAuth reauthentication freshness bypass via cross- user OAuth identity acceptance

Flask-Security-Too allows users to add security features to their Flask applicationa. Version 5.8.0's OAuth reauthentication flow can mark a session as fresh after verifying an OAuth account that belongs to a different user. If an attacker can operate an already-authenticated but stale victim...

CVE-2026-39878 Chamilo stored XSS via user registration leads to admin account takeover

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been...

CVE-2026-39878 Chamilo stored XSS via user registration leads to admin account takeover

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been...

CVE-2026-39878 Chamilo stored XSS via user registration leads to admin account takeover

Chamilo LMS versions 1.11.38 and earlier contain a stored cross-site scripting vulnerability in the user registration form that allows any unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session, leading to full platform admin account takeover. This has been...