CVE-2026-115243: Unknown: The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file…

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an import upload: it checks the extension of a separate request field while saving the uploaded file itself with WordPress's upload type-checking...

CVE-2026-120637: Active Debug Code

CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUESTMETHOD. For a REQUESTMETHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and pathinfo from the...

CVE-2026-122224: retspen webvirtcloud: WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged…

WebVirtCloud through commit bb920b0 contains a missing authorization vulnerability that allows low-privileged authenticated users to reach MigrateViewSet and CreateInstanceViewSet because no permissionclasses are declared, so Django REST Framework defaults to AllowAny. Attackers can send requests...

CVE-2026-121144: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could exploit this vulnerability by downloading application packag...

CVE-2025-71454: vtenext: vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in…

vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrfcheck in include/utils/VteCsrf.php skips csrftoken validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read fro...

CVE-2026-87044: zephyrproject zephyr: The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations

The Mbed TLS crypto shim driver in drivers/crypto/cryptombedtlsshim.c drives PSA multipart cipher and AEAD operations. In mbedtlscbc and mbedtlsaead, every error path after a successful psacipherencryptsetup / psaaeaddecryptsetup returned directly without calling psacipherabort / psaaeadabort...

CVE-2026-13289: IBM MQ: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through…

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this...

CVE-2026-87038: zephyrproject zephyr: The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in…

The user-mode verification handler for the i3ctransfer system call, zvrfyi3ctransfer in drivers/i3c/i3chandlers.c, validated the caller-supplied struct i3cdevicedesc in place instead of snapshotting it. It confirmed only that the descriptor was readable by the calling thread KSYSCALLMEMORYREAD,...

CVE-2026-87041: zephyrproject zephyr: The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before…

The RTIO submission-queue verifier rtiovrfysqe in subsys/rtio/rtiosyscalls.c subsys/rtio/rtiohandlers.c before v4.3.0 accumulated the results of KSYSCALLMEMORY into its validsqe flag with &=. That macro returns nonzero on failure it is built on KSYSCALLVERIFYMSG, which yields !expr, so every buff...

CVE-2026-54851: Awesomemotive Contact Form by WPForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3...

CVE-2026-95649: I.R.I.S S.A. IRISPowerscan: IRISPowerscan insufficiently restrict the use of untrusted scripts

IRISPowerscan insufficiently restrict the use of untrusted scripts. An authenticated user with access to script functionality can import or modify scripts that are executed by the application, potentially resulting in arbitrary code execution in the security context of the Windows user running...

CVE-2026-121925: Snowflake: A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions,…

A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a value taken from the identity provider's...

CVE-2026-102703: Xen: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. A common access pattern is a batch of Grant Copy operations acting on adjacent address ranges in the same source or destination page. For performance reasons, Xen caches...

CVE-2026-121960: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP…

FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP TSRequest omits negoTokens. Unauthenticated attackers can send a crafted seven-byte TSRequest containing only the version field to trigger a fatal WINPRASSERT and abort the server...

CVE-2026-13284: IBM MQ: IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through…

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this...

CVE-2026-122047: Campcodes Complete Advance Loan Management System: A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0

A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function moveuploadedfile of the file /loan/application/banner.php. Such manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The...

CVE-2026-54861: Aguila Technologies WP Customer Area: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila…

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1...

CVE-2026-110944: qt Qt Framework: Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.

Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server...

CVE-2026-79405: Unisoc (Shanghai) Technologies Co., Ltd. Modem: In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration

In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration. This could lead to remote denial of service with no additional execution privileges needed...

CVE-2026-110021: Phoenix Contact PLCnext Engineer: PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue`…

PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML SignatureValue over canonicalized SignedInfo. An unauthenticated local attacker can modify signed GSDML content, update its manifest digest, retain the public certificate data, and leave an inval...