CVE-2026-25186: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor in Windows Accessibility Infrastructure ATBroker.exe allows an authorized attacker to disclose information locally...

PT-2026-24310

Name of the Vulnerable Software and Affected Versions Windows Accessibility Infrastructure ATBroker.exe affected versions not specified Description The issue concerns the insufficient protection of sensitive data within the Windows Accessibility Infrastructure ATBroker.exe. Successful exploitatio...

KB5078774: Windows Server 2012 R2 Security Update (March 2026)

The remote Windows host is missing security update 5078774. It is, therefore, affected by multiple vulnerabilities - Use after free in Windows Print Spooler Components allows an authorized attacker to execute code over a network. CVE-2026-23669 - Use after free in Windows Win32K allows an...

The vulnerability of the shadow copying subsystem of the Secret Net Studio protection tool is related to resource management errors. Exploiting this vulnerability could allow an attacker to influence the accessibility and integrity of the protected information.

The vulnerability of the shadow copying subsystem of the Secret Net Studio protection tool is related to resource management errors. Exploiting this vulnerability could allow an attacker to influence the accessibility and integrity of the protected information...

The vulnerability of the register_shm_helper() function in the drivers/tee/tee_shm.c module of the Linux kernel’s secure execution environment driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the registershmhelper function in the drivers/tee/teeshm.c file, a driver for the secure execution environment of the Linux kernel, is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Broken Access: On the Challenges of Screen Reader Assisted Two-Factor and Passwordless Authentication

In today's technology-driven world, web services have opened up new opportunities for blind and visually impaired people to interact independently. Securing interactions with these services is crucial; however, currently deployed authentication mainly concentrate on sighted users, overlooking the...

The vulnerability of the f2fs_new_node_page() function in the fs/f2fs/node.c file of the F2FS file system in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the f2fsnewnodepage function in the fs/f2fs/node.c file of the F2FS file system in the Linux operating system is related to code errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability in the virtualization subsystem’s arch/x86/kvm/mmu.c module on the Linux operating system’s x86 kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability in the arch/x86/kvm/mmu.c module of the virtualization subsystem on the Linux kernel-based x86 platform is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality,...

The vulnerability of the rxe_srq_from_attr() function in the drivers/infiniband/sw/rxe/rxe_srq.c file of the Linux operating system’s kernel driver InfiniBand allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the rxesrqfromattr function in the drivers/infiniband/sw/rxe/rxesrq.c file of the Linux operating system’s InfiniBand driver is related to the assignment of the NULL pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, a...

The vulnerability of the set_user_sq_size() function in the drivers/infiniband/hw/mlx4/qp.c module of the Linux operating system’s kernel driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setusersqsize function in the drivers/infiniband/hw/mlx4/qp.c module of the Linux operating system’s kernel driver is related to integer overflow or cyclic shift vulnerabilities. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the hci_conn_add_sysfs() function in the net/bluetooth/hci_sysfs.c module of the Linux kernel’s Bluetooth subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hciconnaddsysfs function in the net/bluetooth/hcisysfs.c module of the Linux kernel’s Bluetooth subsystem is related to state management errors. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

Inside a fake Google security check that becomes a browser RAT

A website styled to resemble a Google Account security page is distributing what may be one of the most fully featured browser-based surveillance toolkits we have observed in the wild. Disguised as a routine security checkup, it walks victims through a four-step flow that grants the attacker push...

CVE-2026-2362

The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the "Long Description UI" feature in all versions up to, and including, 2.3.1. This is due to the plugin's JavaScript retrieving the alt attribute using...

CVE-2026-2362

CVE-2026-2362 affects the WP Accessibility plugin for WordPress (versions

CVE-2026-2362 WP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute

The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the "Long Description UI" feature in all versions up to, and including, 2.3.1. This is due to the plugin's JavaScript retrieving the alt attribute using...

CVE-2026-2362 WP Accessibility <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute

The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the "Long Description UI" feature in all versions up to, and including, 2.3.1. This is due to the plugin's JavaScript retrieving the alt attribute using...

WordPress plugin WP Accessibility 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

CVE-2026-2362: Improper Neutralization of Input During Web Page Generation

The WP Accessibility plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'alt' attribute of images processed by the "Long Description UI" feature in all versions up to, and including, 2.3.1. This is due to the plugin's JavaScript retrieving the alt attribute using...

The vulnerability of the Connection::handleWriteResponse() function in the src/http/Connection.C module of the web server wt allows an attacker to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the Connection::handleWriteResponse function in the src/http/Connection.C module of the web server allows for the reuse of previously freed memory. Exploiting this vulnerability could enable a malicious actor to compromise the confidentiality and accessibility of the protecte...

WordPress WP Accessibility plugin <= 2.3.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'alt' Attribute vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via 'alt' Attribute vulnerability discovered by Quốc Huy jtwings - Puramu in WordPress Plugin WP Accessibility versions = 2.3.1...