CVE-2026-93900: elliotvs Simple CAPTCHA with Cloudflare Turnstile: The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the gravity-simple-turnstile shortcode in versions up to, and including, 1.44.3 This is due to insufficient input sanitization and output escaping on the...

CVE-2026-121962: FreeRDP: FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User…

FreeRDP before 3.32.2 contains a heap buffer overflow in transportdefaultreadpdu when handling partial Early User Authorization reads during PROTOCOLHYBRIDEX CredSSP. A malicious RDP server can split the four-byte EUA result into short reads that advance the stream pointer beyond the 16 KiB...

CVE-2026-76419: Cisco Cisco Unified Communications Manager: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco…

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user o...

CVE-2026-121942: mchehab zbar: ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows…

ZBar through 0.23.95 contains an out-of-bounds read vulnerability in zbarsqdecode in zbar/sqcode.c that allows attackers to read heap memory outside the image buffer via crafted SQ code images. Attackers can supply an image with a skewed SQ code finder pattern near the edge, producing unchecked...

Linux Distros Unpatched Vulnerability : CVE-2026-18375

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - pagure - None CVE-2026-18375 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc...

CVE-2026-100407: git-for-windows git: Git for Windows is the Windows port of Git

Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses scwprintf to size a formatted wide-character credential buffer without space for the terminating NUL whe...

CVE-2026-111821: Apache Software Foundation: Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB

Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length 65,535 while separately being shorter on a broker using KahaDB which can cause the broker to shutdown and ...

CVE-2026-105296: Akeeba Ltd.: Multiple Akeeba products lack the anti-CSRF check on some actions

Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may be performed...

CVE-2026-121956: FreeRDP: FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the…

FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the krb5 default realm into a target principal that has an empty realm without taking ownership of it. Unauthenticated remote clients can send a crafted NLA/CredSSP u2u TGT request who...

CVE-2026-92187: Quest Foglight for Databases: Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability

Quest Foglight for Databases extractAndCreateUploadInfoList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this...

CVE-2026-121609: Qihoo 360 Whole Home Router M5: A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566

A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component Boot Script. The manipulation leads to hard-coded credentials. Remote exploitation of the attack is possible. The exploit is publicly...

CVE-2026-121606: Qihoo 360: A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9

A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function verifysign of the file fs2/bin/iscm of the component Firmware Signature Verification. Such manipulation of the argument sign leads to improper verification...

CVE-2026-121617: Linksys E5600: A security flaw has been discovered in Linksys E5600 1.1.0.26

A security flaw has been discovered in Linksys E5600 1.1.0.26. Affected by this issue is the function initmultipart of the file /cgi-bin/uploadfw.cgi of the component Header Parser. The manipulation results in out-of-bounds write. The attack may be launched remotely. The exploit has been released...

CVE-2026-121589: spatie url-signer: A weakness has been identified in spatie url-signer up to 2.1.3

A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the file AbstractUrlSigner.php of the component URL Validation. This manipulation of the argument expires causes incorrect type conversion. It is possible to initiate the attac...

CVE-2026-121599: TOTOLINK A950RG: A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104

A vulnerability was detected in TOTOLINK A950RG 4.1.2cu.5268B20221104. Affected is the function setWiFiMultipleConfig/delWiFiMultipleConfig of the file /cgi-bin/cstecgi.cgi of the component Multi-SSID Configuration. The manipulation of the argument wepkey2/wepkey3 results in stack-based buffer...

CVE-2026-121600: TOTOLINK A950RG: A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC Filter Handler. This manipulation of the argument addEffect causes stack-based buffer overflow. The attack can be...

CVE-2026-121817: About Time Technologies Herowatch Go Server: Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability

Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions...

CVE-2026-77690: Zohocorp ManageEngine Key Manager Plus: ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that…

ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target...

CVE-2026-59267: Apache Software Foundation Apache OpenOffice: A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier

A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes this issue...

CVE-2026-108500: Apache Software Foundation Apache ActiveMQ: Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an…

Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to create or address a destination with a crafted name containing LDAP DN special characters such as comma, plus, equals, backslash can manipulate the LDAP search ba...