CVE-2026-47678: glpi-project glpi: GLPI is a free asset and IT management software package

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This permits SQL injection through the dropdown endpoint. This issue...

CVE-2026-100235: Apache Software Foundation Apache ZooKeeper: Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of…

Incorrect authorization due to a time-of-check to time-of-use TOCTOU race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outstanding change record for that node. Any request that is prepare...

CVE-2026-100252: Apache Software Foundation Apache ZooKeeper: Improper Authorization vulnerability in Apache ZooKeeper

Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...

Fedora 45 : rust-qemu-rdp (2026-73b3c9f69b)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-73b3c9f69b advisory. Rebuilt with rustls-webpki 0.103.16 for RUSTSEC-2026-0382. This provides added protection against trusting the eMudhra intermediate CA certificates, which...

MiracleLinux 9 : java-25-openjdk-25.0.5.0.8-1.0.el9.ML.1 (AXSA:2026-2238:14)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2238:14 advisory. JDK: Enhance PKCS5 padding CVE-2026-83374 JDK: Enhance TLS certificate handling CVE-2026-83376 JDK: Improve C2 loop transformations CVE-2026-83378...

CVE-2026-62000: WC Lovers WCFM Marketplace: Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting…

Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Marketplace: from n/a through 3.8.2...

CVE-2026-118627: MLflow: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

MLflow SHAP loadexplainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2026-11753: LY Corporation Armeria: A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is…

A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL...

CVE-2026-87039: zephyrproject zephyr: The user-mode syscall verifier z_vrfy_i2s_configure() in drivers/i2s/i2s_handlers.c copies the caller's struct…

The user-mode syscall verifier zvrfyi2sconfigure in drivers/i2s/i2shandlers.c copies the caller's struct i2sconfig in from user memory and then, when cfg-frameclkfreq is 0 the API's "unconfigure the stream" request, jumps straight to zimpli2sconfigure without performing the...

CVE-2026-121585: InfiniFlow RAGFlow: A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2

A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in authorization bypass. The attack may b...

Linux Distros Unpatched Vulnerability : CVE-2026-114582

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform...

CVE-2026-110935: Phoenix Contact PLCnext Engineer: The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the…

The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plug...

CVE-2026-115426: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage…

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup locati...

Linux Distros Unpatched Vulnerability : CVE-2026-121236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121245

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121211

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social...

Linux Distros Unpatched Vulnerability : CVE-2026-121008

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL::Abstract::Tree versions before 2.00000104 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile...

CVE-2026-108949: Apache Software Foundation: Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker

Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ Broker. An authenticated OpenWire client that sends a ConsumerInfo for a temporary queue/topic owned by another connection is rejected with InvalidDestinationException, but the rejected Subscription is left behind in the region'...

CVE-2026-119468: Noptin Newsletter Team Noptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through 4.4.2...

Linux Distros Unpatched Vulnerability : CVE-2026-121239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium securit...