CVE-2026-106991: n/a: hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control

hustoj =24.09.10 and =26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread including admins' announcements via threadadmin.php. The thread branch only verifies login, never authorship or admin rights...

CVE-2026-121554: silkimen cordova-plugin-advanced-http: cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to…

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or...

CVE-2026-103429: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-100493: AMD AMD Compressionator SDK: An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS…

An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS file that causes an undersized heap allocation and a subsequent out-of-bounds read, potentially resulting in process termination or limited disclosure of heap memory...

CVE-2026-121578: Amidaware Tactical RMM: Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various…

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading t...

CVE-2026-108047: AM System ALO Suite: Inadequate authorization vulnerability in Alosuite’s user invitation functionality

Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepti...

CVE-2026-121402: FreeRDP: FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash…

FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdiresizeex leaves the primary display null without ending the session, so a later bitmap upda...

CVE-2026-121403: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a…

FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICEIOREQUEST with a truncated IRPMJCREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting...

CVE-2026-97350: Securepoint Securepoint SSL VPN Client v2: Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy…

Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\SYSTEM privileges. Two attack vectors have been identified: Improper authorizati...

CVE-2026-121421: surrealdb: SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching…

SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules HOST:PORT or IP:PORT match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http:: functio...

CVE-2026-108050: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality

A stored Cross-Site Scripting XSS vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation require...

CVE-2026-119843: Red Hat, GStreamer project: A flaw was found in GStreamer's gst-plugins-good package

A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availability when processing enhanced audio and video tags in malformed or truncated FLV streams. A remote attacker could exploit this vulnerability by providing a...

CVE-2026-99257: Linux: In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of…

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no device associated currently causes a...

CVE-2026-99258: Linux: In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in…

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

CVE-2026-104647: Unknown weMail: The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission…

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list Editor and above by default as authorised for every action, which allows such...

CVE-2026-121172: Google Chrome: Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI…

Incorrect authorization in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121217: Google Chrome: Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary…

Use after free in Streaming in Google Chrome prior to 157.0.8103.38 allowed an adjacent attacker to execute arbitrary code inside the sandbox via crafted network traffic. Chromium security severity: Low...

CVE-2026-118527: Ivanti Connect Secure: Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote…

Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk...

CVE-2026-121627: jarun buku: buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows…

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView.listentry. Attackers can submit a URL containing a double quote and event handler through the...

CVE-2026-121512: D3TN GmbH µD3TN: Memory Leak with Amplification in µD3TN BPv6 EID Reference Handling allows Unauthenticated Remote Attacker to Cause DoS

Memory Leak with Amplification in µD3TN BPv6 EID Reference Handling allows Unauthenticated Remote Attacker to Cause DoS...