CVE-2026-5696

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Microweber administration panel. The flaw is located within the 'group' parameter of the '/admin/settings' endpoint. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code i...

CVE-2026-93368

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2026-93368

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to a time-based SQL Injection in all versions up to and including 2.0.1 . The root cause is insufficient escaping and a lack of sufficient preparation on the existing SQL query for the 'log' (Username) parameter. Beca...

EUVD-2026-85169

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

CVE-2026-61548

A flaw was found in Rsyslog, a system for log processing. A remote unauthenticated attacker could exploit a stack buffer overflow vulnerability within the optional mmpstrucdata plugin. By sending a specially crafted RFC5424 message containing an oversized structured-data parameter, the attacker c...

postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes 0x0 and 0x1 to server memory, which may lead to unknown impacts...

CVE-2026-63445

A flaw was found in Perses, an open-source dashboard and visualization project. An authenticated attacker can exploit a vulnerability in list endpoints that use the file-system database. By manipulating the project query parameter with directory traversal characters, an attacker can read arbitrar...

EUVD-2026-84991

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability in the photo search endpoint where the query parameter is passed unsanitized into SQL WHERE and ORDER BY clauses. Unauthenticated attackers can exploit time-based blind SQL injection techniques to extract user credentials...

PT-2026-97518

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description Sulu is an open-source PHP content management system based on the Symfony framework. A JCR-SQL2 injection exists in the Smart Content QueryBuilder within...

CVE-2026-96652: Server-Side Request Forgery (SSRF)

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

CVE-2026-5696: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This...

PT-2026-97268

Name of the Vulnerable Software and Affected Versions Microweber affected versions not specified Description Reflected Cross-Site Scripting XSS occurs in the administration panel. The issue exists within the /admin/settings endpoint via the group parameter. An attacker can trick an authenticated...

Extracting CNNs in the Unknown-Architecture and Feedback-Agnostic Setting

This paper studies the cryptanalytic extraction of convolutional neural networks CNNs. Existing cryptanalytic extraction attacks on CNNs assume that the network architecture is known, and try to recover model parameters.In this paper, we prove for the first time that the architecture assumption c...

PT-2026-97403

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

PT-2026-97241

Name of the Vulnerable Software and Affected Versions Rename wp-login.php to anything you want versions prior to 2.0.2 Description The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before...

CVE-2026-93368: Improper Neutralization of Special Elements used in an SQL Command

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2026-97345

Name of the Vulnerable Software and Affected Versions Isotope eCommerce versions prior to 2.9.11 Description The software generates order identifiers using the uniqid function rather than a cryptographically secure source, which allows unauthenticated attackers to predict these identifiers. Becau...

PT-2026-97565

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.1 Description An issue exists in the trace consumer where the output path is...

CVE-2026-87022: Improper Handling of Length Parameter Inconsistency

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is used. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following...