CVE-2025-71456: vtenext: vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject…

vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database contents, including password reset tokens stored in...

CVE-2026-76892: tsparticles, @tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated...

CVE-2026-100407: git-for-windows git: Git for Windows is the Windows port of Git

Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses scwprintf to size a formatted wide-character credential buffer without space for the terminating NUL whe...

CVE-2026-97705: moleculerjs moleculer: Moleculer is a progressive microservices framework for Node.js

Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser.write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated peer could supply a negative value that caused packet.sliceleng...

CVE-2026-121971: Exposure of Sensitive Information

The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as authbearer or authbasic into a request before resolving a relative URL against the baseuri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together...

Linux Distros Unpatched Vulnerability : CVE-2026-121077

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code...

CVE-2026-76826: tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations

tsParticles is a TypeScript library for creating highly customizable particle animations. From 4.0.0 until 4.3.2, the stable publish workflow interpolates steps.release.outputs.body directly into an echo command in Bash source before writing RAWRELEASE.md. Contributor-controlled shell...

Linux Distros Unpatched Vulnerability : CVE-2026-121234

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside th...

Oracle Linux 10 : firefox (ELSA-2026-93956)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-93956 advisory. 153.6.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding R...

Linux Distros Unpatched Vulnerability : CVE-2026-119555

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the...

Linux Distros Unpatched Vulnerability : CVE-2026-121064

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandb...

Linux Distros Unpatched Vulnerability : CVE-2026-121087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121102

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-121250

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary co...

Linux Distros Unpatched Vulnerability : CVE-2026-121105

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium...

Linux Distros Unpatched Vulnerability : CVE-2026-111362

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.OGRGeometry does not restrict external...

CVE-2026-122120: Yealink Plug-in Softwares: In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific…

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution...

Linux Distros Unpatched Vulnerability : CVE-2026-121125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive...

Linux Distros Unpatched Vulnerability : CVE-2026-121073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafte...

Linux Distros Unpatched Vulnerability : CVE-2026-121067

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements v...