CVE-2026-105967: Unknown Gallery for Social Photo: The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to…

The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses...

CVE-2026-108327: Tanium: Tanium addressed a path traversal vulnerability in Tanium Data Service.

Tanium addressed a path traversal vulnerability in Tanium Data Service...

CVE-2026-115878: stanfordnlp stanza: Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human…

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. From 1.14.0 until 1.15.0, loading an attacker-supplied lemmatizer checkpoint can execute arbitrary code because stanza/models/lemma/trainer.py stores posdict as gzip-compress...

CVE-2026-116648: Tanium Discover: Tanium addressed an improper output sanitization vulnerability in Discover.

Tanium addressed an improper output sanitization vulnerability in Discover...

CVE-2026-116651: Tanium Threat Response: Tanium addressed an unauthorized code execution vulnerability in Threat Response.

Tanium addressed an unauthorized code execution vulnerability in Threat Response...

CVE-2026-116663: Tanium Enforce: Tanium addressed an improper access controls vulnerability in Enforce.

Tanium addressed an improper access controls vulnerability in Enforce...

CVE-2026-116653: Tanium Threat Response: Tanium addressed an improper input validation vulnerability in Threat Response.

Tanium addressed an improper input validation vulnerability in Threat Response...

CVE-2026-116650: Tanium Threat Response: Tanium addressed an unauthorized code execution vulnerability in Threat Response.

Tanium addressed an unauthorized code execution vulnerability in Threat Response...

CVE-2026-120567: MongoDB Entity Framework Core Provider: The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value…

The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value into a bulk update that is expressed as a databasea result, a value supplied as plain data may be interpreted by the database as expression syntax. A part value through normal...

CVE-2026-121263: phpMyAdmin MoTranslator: A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1

A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performed from remote. Th...

CVE-2026-121252: Google Chrome: Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin…

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

CVE-2026-45146: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system

Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the getsessions action in /main/inc/ajax/model.ajax.php with search=true and a crafted JSON filters parameter whose groupOp field contains SQL syntax. Because groupOp is n...

CVE-2026-121107: Google Chrome: Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass…

Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: High...

CVE-2026-121048: Google Chrome: Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside…

Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121067: Google Chrome: UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging…

UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-121123: Google Chrome: Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…

Use after free in Canvas in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-121124: Google Chrome: Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to…

Improper adherence to coding standards in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-82976: Red Hat: A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack

A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images...

CVE-2026-77778: Zohocorp ManageEngine Key Manager Plus: ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging…

ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults...

CVE-2026-82155: Dell OS Recovery tool: Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability

Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution...