CVE-2026-122028: NST Labs Tech Nstbrowser: A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0

A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has...

CVE-2026-115758: sumatrapdfreader sumatrapdf: SumatraPDF is a multi-format reader for Windows

SumatraPDF is a multi-format reader for Windows. In version 3.6.1 and earlier, HttpGet in src/base/Httpwin.cpp unconditionally passes INTERNETFLAGIGNORECERTCNINVALID to WinINet, disabling hostname matching for HTTPS update metadata and crash-symbol requests while retaining certificate-chain...

CVE-2026-121817: About Time Technologies Herowatch Go Server: Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability

Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions...

CVE-2026-118783: Unknown All-in-One Video Gallery: The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode…

The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting...

CVE-2026-108588: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing X-Content-Type-Options header allowing MIME type sniffing...

CVE-2026-121638: WatchGuard AuthPoint Authentication Gateway: An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path…

An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers...

CVE-2026-102339: telepresenceio telepresence: Telepresence enables local development against a remote Kubernetes or OpenShift cluster

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and passes it to state.Tunnel without...

CVE-2026-19319: IBM Watson Speech Services Cartridge: IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to obtain sensitive information…

IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...

CVE-2026-19721: TÜBİTAK BİLGEM Software Technologies Research Institute İmzager: Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research…

Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allows Serialized Data External Linking. This issue affects İmzager: from 2.10.5 before 2.10.7...

CVE-2026-105702: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages containing internal implementation details...

CVE-2026-121929: EmpireSoft EmpireCMS: A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0

A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.php. The manipulation of the argument spacename results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to...

CVE-2026-108767: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers...

CVE-2026-121007: SQL Injection

SQL::Abstract versions from 1.9001 before 2.00000104 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as -select = ... in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These...

CVE-2026-62365: wazuh: Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte joindata heap buffer but passes t...

CVE-2026-102340: telepresenceio telepresence: Telepresence enables local development against a remote Kubernetes or OpenShift cluster

Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on port 8081 accepts unauthenticated cluster-network callers, ArriveAsClient stores a caller-supplied Namespace using only the ManagesNamespace manager watchlist...

CVE-2026-122192: AWS firecracker: Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with…

Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVMs restored from a snapshot with the File memory backend, if...

CVE-2026-54375: Shenzhen Shine Industrial Co., Ltd. VitaFit: VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that…

VitaFit Android application com.vt.vitafit before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted msessionid tokens stored in application backups, which remain valid for ten years. Attackers can use a stolen session token to...

CVE-2026-108838: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a local attacker to cause a denial of service due to…

IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a local attacker to cause a denial of service due to uncontrolled resource consumption...

CVE-2026-118422: Unknown Stape Conversion Tracking: The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin…

The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect the server-side request to an arbitrary host and have the response body and its content type returned fr...

CVE-2026-113371: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST…

Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository...