CVE-2026-116666: Tanium Discover: Tanium addressed an information disclosure vulnerability in Discover.

Tanium addressed an information disclosure vulnerability in Discover...

CVE-2026-121627: jarun buku: buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows…

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView.listentry. Attackers can submit a URL containing a double quote and event handler through the...

CVE-2026-121728: SourceHut meta.sr.ht: SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated…

SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credentials to /register/step2, which invokes the...

CVE-2026-121729: 0xdps emailflare: emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes…

emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke...

CVE-2026-121730: 0xdps emailflare: emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows…

emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows authenticated members to send mail as any sender address. Attackers can supply an arbitrary from field, which is passed unchecked to the Cloudflare send call, to impersonate othe...

CVE-2026-121733: Webkul Bagisto: Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload…

Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attachment containing JavaScript served under...

CVE-2026-16900: Zohocorp: Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass…

Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request...

CVE-2026-22058: NETAPP StorageGRID (formerly StorageGRID Webscale): StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge…

StorageGRID formerly StorageGRID Webscale versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests...

CVE-2026-120577: wpmanageninja: The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary…

The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFile function in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers,...

CVE-2026-120327: TYPO3 Extension "Mail": The click tracking middleware accepts an arbitrary target URL and redirects to it

The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites...

CVE-2026-120534: ACF Extended Advanced Custom Fields: Extended PRO: The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions…

The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the renderfield function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing ...

CVE-2026-120538: smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy: The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account…

The Easy Digital Downloads plugin for WordPress is vulnerable to authentication bypass leading to administrator account takeover in all versions up to, and including, 3.7.2. During a PayPal guest checkout, the email address entered in the guest-checkout field is trusted as proof of identity:...

Linux Distros Unpatched Vulnerability : CVE-2026-99262

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iouring/timeout: don't lose a cancel as io-wq arms a timeout An IORINGOPTIMEOUT run by io-wq, because of IOSQEASYNC, has the same problem as poll, futex and...

CVE-2025-71452: Vembu Technologies BDRSuite: Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in…

Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in templates/progress/clientside/restoreprogress.sgp that allows remote attackers to inject arbitrary JavaScript by manipulating request parameters such as mn, rnm, isRepliRestore, rusr, and rpwd that are...

CVE-2026-103077: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2...

CVE-2026-104647: Unknown weMail: The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission…

The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list Editor and above by default as authorised for every action, which allows such...

CVE-2026-104608: GitHub Enterprise Server: A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld)

A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service babeld. babeld held references into internal collections while calling into the SSH library, where a re-entrant callback could modify a collection and invalidate those references. An attacker with ...

CVE-2022-29966: Emerson Ovation: Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller…

Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition...

CVE-2026-115779: Effect-TS, @effect: Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript…

Effect is a TypeScript framework that consists of several packages that work together to help build TypeScript applications. From @effect/platform 0.1.0 until 0.97.1 and effect 4.0.0-beta.0 until 4.0.0-beta.103, the name, domain, and path fields passed to makeCookie allow semicolon delimiters tha...

CVE-2026-115297: Elastic Packetbeat: NULL Pointer Dereference (CWE-476) in the AMQP protocol parser in Packetbeat can lead to denial of service via…

NULL Pointer Dereference CWE-476 in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the...