PT-2026-67387

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server MDS could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful...

The vulnerability of the Google Chrome browser’s Navigation function allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Google Chrome browser’s Navigation function is related to improper protection of physical external channels. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of Google Chrome’s GPU component, which allows a hacker to trigger a service failure

The vulnerability of Google Chrome’s GPU component is related to reading beyond the buffer in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

The vulnerability of Google Chrome’s fullscreen mode allows attackers to carry out spoofing attacks.

The vulnerability of Google Chrome’s fullscreen mode is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...

The vulnerability of Google Chrome, related to the use of memory after it is freed, allows a hacker to execute arbitrary code.

The vulnerability of Google Chrome relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of Google Chrome’s FileSystem component, which allows a hacker to trigger a service failure.

The vulnerability of Google Chrome’s FileSystem component is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

EUVD-2026-52484

Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...

CVE-2026-52520

CVE-2026-52520 affects Emlog CMS

PT-2026-67019

In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check...

PT-2026-67429

Name of the Vulnerable Software and Affected Versions GNU tar affected versions not specified Description A TOCTOU Time-of-Check Time-of-Use issue exists in the incremental dumpdir X rename handling. This occurs when a local attacker with write access to a directory being backed up can influence...

The vulnerability of the SiteIsolation component in the Google Chrome browser allows a hacker to trigger a service failure.

The vulnerability of Google Chrome’s SiteIsolation component is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260803-73-0011

The vulnerability of the ngxhttpssimodule module in NGINX Plus and NGINX Open Source HTTP servers relates to the possibility of using memory after it is freed. Exploiting this vulnerability allows a remote attacker to modify the memory contents of the working process or cause service failures...

PT-2026-67485

Name of the Vulnerable Software and Affected Versions Amazon MQ MCP Server awslabs.amazon-mq-mcp-server versions prior to 2.0.24 Description Improper restriction of intended endpoints in the RabbitMQ broker connection tools may allow a remote unauthenticated actor to obtain Amazon MQ for RabbitMQ...

SUSE CVE-2026-18321

Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd...

CVE-2026-64371

A flaw was found in the Linux kernel's procfs a virtual filesystem that provides information about running processes. This vulnerability occurs because certain functions within procfs do not properly protect access to process memory information. A local attacker could exploit this missing...

EUVD-2026-51991

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences and both resolve through a generic web.Auth.GetID interface, a link-share JWT whose numeric ID equals a target user's ID is...

CVE-2026-12231

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ exadinfoboximage’ parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-16261

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as a...

CVE-2026-16261

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as a...

EUVD-2026-51943

The login-social WordPress plugin through 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data, allowing unauthenticated attackers to reset any user's password or log in as a...