CVE-2026-59888

A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...

CVE-2026-11598

The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

EUVD-2026-49734

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash which removes...

EUVD-2026-49733

In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands...

CVE-2026-14169

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...

CVE-2026-53666

A flaw was found in React Router. If an application is configured to allow attacker-supplied input to modify errors during server-side rendering SSR, a remote attacker could trigger unexpected code execution on the client. This execution could lead to an outbound network request, potentially...

CVE-2026-8167 Reflected XSS in theWP's News Theme V8

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XSS. This issue affects News Theme V8: through 16.06.2026...

CVE-2026-8167

CVE-2026-8167 describes a Reflected XSS vulnerability in THEWP Digital Solutions’ News Theme V8. The issue stems from improper neutralization of input during web page generation , enabling reflected cross-site scripting. Affected product: News Theme V8 (up to 16.06.2026). The documents do not pro...

USN-8620-1: Linux kernel vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose...

USN-8618-1: Linux kernel vulnerabilities

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. CVE-2025-54518 Several security issues...

CVE-2026-14870

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2026-59922

A flaw was found in Mistune, a Python Markdown parser. A remote attacker could exploit this vulnerability by providing specially crafted input containing specific marker pairs tilde, equals-sign, or caret. This crafted input causes the parser to perform quadratic work, leading to excessive CPU...

CVE-2026-14870 Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2026-16414

A flaw was found in Chromecast within Google Chrome. This vulnerability, caused by insufficient validation of untrusted input, allows a local attacker to exploit the system. By sending malicious network traffic, the attacker can potentially perform a sandbox escape, gaining unauthorized access...

CVE-2026-16422

A flaw was found in Google Chrome. Insufficient validation of untrusted input in the Certificate component allows an attacker in a privileged network position to perform domain spoofing. This can be achieved by sending malicious network traffic, leading to a user being misled about the authentici...

CVE-2026-16415

A flaw was found in Google Chrome Extensions. This vulnerability, caused by insufficient validation of untrusted input, allows a remote attacker to spoof the contents of the Omnibox URL bar. By crafting a malicious HTML page, an attacker could mislead users about the authenticity of a website...

CVE-2026-51263

schreibfaul1 ESP32-audioI2S 3.4.5 is vulnerable to Buffer Overflow. The Audio::openaispeech function in the Audio library manually constructs JSON request bodies and HTTP request headers by directly concatenating externally controllable input and instructions strings without effective length...

CVE-2026-51252

schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::UnpackSFMPEG1 function due to missing input validation on attacker-controlled MP3 metadata...

EUVD-2026-49867

schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the connecttospeech function. The application accepts attacker-controlled long speech text input, performs URL encoding, and directly appends the encoded result into a fixed psptr heap buffer when constructing HTT...

CVE-2026-51266

schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the HTTP request header construction logic. The application dynamically splices attacker-controlled host name, path, query string, and multiple HTTP header fields into a fixed psptr heap buffer without proper size...