CVE-2026-24267

NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information...

CVE-2026-24239

NVIDIA NeMo Speech for all platforms contains a vulnerability where processing malicious data created by an attacker can lead to remote code execution . A successful exploit may result in code execution, information disclosure, and data tampering. This issue is associated with CWE-502 (Deserializ...

Security Bulletin: Due to the use of Apache ActiveMQ All, IBM Sterling Control Center is vulnerable to Improper Authorization and Improper Input Validation (CVE-2026-59878, CVE-2026-61487)

Summary Apache ActiveMQ All is used by IBM Sterling Control Center as part of dependency in activemq-all-5.19.0.jar. Vulnerability Details CVEID:CVE-2026-59878 DESCRIPTION: Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote...

K000163364: Vim vulnerabilities CVE-2025-1215, CVE-2025-22134, CVE-2025-24014

Security Advisory Description CVE-2025-1215 A vulnerability classified as problematic was found in vim up to 9.1.1096. This vulnerability affects unknown code of the file src/main.c. The manipulation of the argument --log leads to memory corruption. It is possible to launch the attack on the loca...

golang-fips: Golang FIPS zeroed buffer

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

PDF_XSS

Payloads All The PDFs A list of crafted malicious PDF files...

PT-2026-95785

Name of the Vulnerable Software and Affected Versions VW Writer Blog theme for WordPress versions prior to 1.3.9 Description The software allows unauthorized modification of data because the vw writer blog reset all settings function lacks a proper capability check. Authenticated users with...

PT-2026-102433

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=562985572 Crash type: Heap-buffer-overflow READ 1 Crash state: sas7bdat parse all pages pass2 readstat parse sas7bdat fuzz format sas7bdat.c...

WordPress All-in-One WP Migration and Backup plugin < 7.111 - Authenticated Privilege Escalation to Admin vulnerability

Authenticated Privilege Escalation to Admin vulnerability discovered by Charles Vosburgh in WordPress Plugin All-in-One WP Migration versions 7.111...

WordPress All Bootstrap Blocks plugin 1.3.20-1.3.31 - Contributor+ LFI vulnerability

Contributor+ LFI vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin All Bootstrap Blocks versions 1.3.20-1.3.31...

CVE-2026-17586

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-17586 VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-17586

The VK All in One Expansion Unit WordPress plugin (versions up to and including 9.118.0 ) is vulnerable to Stored Cross-Site Scripting via the vkExUnit_cta_img_position post meta field. The root cause is insufficient input sanitization and output escaping: the sanitize_text_field callback on save...

EUVD-2026-82746

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-17586 VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-88994

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

CVE-2026-18317

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-18317 Foxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Parameter of toggle_watermark AJAX Action

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

EUVD-2026-82743

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-18317

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images WordPress plugin (versions ≤ 2.5.3 ) contains an authorization bypass in the toggle_watermark AJAX action. The plugin fails to properly verify that the requesting user is authorized to perform the action via the option_k...