CVE-2026-81737

The FAQ Builder AYS WordPress plugin (versions 1.6.3-1.8.4 ) is vulnerable to Stored XSS because it fails to properly sanitize or escape content submitted by unauthenticated visitors . While some escaping is applied, it is bypassed by a subsequent decoding step before the data is displayed in an ...

CVE-2026-16983

The Gutentor WordPress plugin versions prior to 4.0.6 is vulnerable to sensitive information disclosure. The flaw exists because the plugin fails to apply proper context restrictions to one of its REST endpoints . This oversight allows any authenticated user with at least a Subscriber role to acc...

CVE-2026-16983 Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

EUVD-2026-69866

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

K000163170: Mbed TLS vulnerability CVE-2026-34877

Security Advisory Description An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary...

PT-2026-84638

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

PT-2026-84608

The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plaintext passwords of password-protected posts to any authenticated user with at least the Subscriber role...

PT-2026-84841

PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T CTX-typed base register as a silent no-op: do mem store in src/crab/ebpf transformer.cpp only models T STACK stores, and the...

CVE-2026-73731

A reflected cross-site scripting (XSS) vulnerability in the web-based management interface of HPE Networking Fabric Composer allows an unauthenticated remote attacker to execute arbitrary script code in a victim's browser. The attack requires user interaction (e.g., clicking a crafted link) and r...

CVE-2026-80704

A flaw was found in the Linux kernel's drm/amd/display component. This vulnerability arises from the improper use of an uninitialized logging context, which can lead to a NULL pointer dereference. A local attacker could potentially trigger this flaw, causing the system to crash and resulting in a...

VulnCheck KEV: CVE-2023-39470

PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability. The specific flaw exists with...

glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

CVE-2026-14367

CVE-2026-14367 affects the Zephyr RTOS I3C IBI subsystem in drivers/i3c/i3c_ibi_workq.c. A statically-allocated work-node free-list (sys_slist_t) is accessed without synchronization: ISR-context callers invoke sys_slist_get() while the workqueue thread calls sys_slist_append(). This data race can...

CVE-2026-42588

A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...

PT-2026-83952

The I3C IBI subsystem in drivers/i3c/i3c ibi workq.c hands out statically-allocated work nodes through a free-list i3c ibi work nodes free implemented as a plain sys slist t, which provides no synchronization. The allocation helpers i3c ibi work enqueue, i3c ibi work enqueue target irq, i3c ibi...

Same Request, Different Boundary: Evaluating Cybersecurity Assistance across Conversational Contexts

Large Language Models LLMs can solve complex problems, but their misuse in high-risk domains can lead to severe consequences. Model providers therefore restrict assistance for potentially harmful requests. Refusing all cybersecurity requests would therefore harm legitimate users. Providers need a...

Linux Distros Unpatched Vulnerability : CVE-2026-80699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context In the nested state, the physical interrupt has already been deactivated through the HW...

CVE-2026-82587

A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amfnamfcommdecodeuemmcontextlist of the file src/amf/namf-handler.c of the component AMF. This manipulation of the argument ueContext.mmContextList.allowedNssai causes memory corruption. The attack can ...

CVE-2026-82587 Open5GS AMF namf-handler.c amf_namf_comm_decode_ue_mm_context_list memory corruption

A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function amfnamfcommdecodeuemmcontextlist of the file src/amf/namf-handler.c of the component AMF. This manipulation of the argument ueContext.mmContextList.allowedNssai causes memory corruption. The attack can ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-002649)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-002649 advisory. In the Linux kernel, the following vulnerability has been resolved: i2c: pnx: Fix potential deadlock warning from deltimersync call in isr When deltimersync is calle...