IBM MQ 9.1 < 9.1.0.38 LTS / 9.2 < 9.2.0.44 LTS / 9.3 < 9.3.0.42 LTS / 9.4 < 9.4.0.26 LTS / 9.3 - 10.0.0.0 CD < 10.0.0.5 (7284895)

The version of IBM MQ Server running on the remote host is 9.1.0.0 prior to 9.1.0.38 LTS, or 9.2.0.0 prior to 9.2.0.44 LTS, or 9.3.0.0 prior to 9.3.0.42 LTS, or 9.4.0.0 prior to 9.4.0.26 LTS, or a 9.3.x / 9.4.x CD release, or 10.0.0.0. It is, therefore, affected by a vulnerability as referenced i...

CVE-2026-93750: Interpretation Conflict

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the varyMatches function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intende...

EulerOS 2.0 SP10 : gnutls (EulerOS-SA-2026-3738)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform...

Cisco Identity Services Engine MnTRESTLivelogService XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Cisco Identity Services Engine. Authentication is required to exploit this vulnerability. The specific flaw exists within the MnTRESTLivelogService class. Due to the improper restriction of X...

CVE-2026-18441 LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

CVE-2026-18441 LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

CVE-2026-18441

The LatePoint – Appointment Booking & Scheduling WordPress plugin (≤ 5.6.9) is vulnerable to an unauthenticated Insecure Direct Object Reference (IDOR) via the customer[id] parameter. The root cause is missing validation on a user-controlled key in the set_customer_object function, allowing attac...

CVE-2026-78501

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

CVE-2026-68791

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network...

CVE-2026-55946

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

CVE-2026-85887

CVE-2026-85887 is an information disclosure vulnerability in M365 Copilot caused by an incorrect permission assignment on a critical resource. An attacker with low privileges (authorized access) can disclose information over a network. The CVSS 3.1 score is 7.7 (HIGH) with a changed scope and hig...

CVE-2026-78501

CVE-2026-78501 is a command injection vulnerability in Microsoft 365 Copilot's Business Chat , caused by improper neutralization of special elements used in a command. An unauthorized attacker can exploit it over a network to disclose information . The CVSS v3.1 score is 7.4 (HIGH) , with a vecto...

CVE-2026-68791

CVE-2026-68791 is an incorrect authorization vulnerability in Azure Machine Learning that allows an unauthenticated, network-based attacker to disclose information with HIGH severity (CVSS 3.1: 8.6). The attack requires no prior privileges or user interaction, and the scope is CHANGED , indicatin...

CVE-2026-55946

CVE-2026-55946 is a command injection vulnerability in Microsoft Copilot resulting from improper neutralization of special elements used in a command. An unauthorized remote attacker can leverage this to disclose information over a network . The CVSS 3.1 score is 6.1 (MEDIUM) with the vector AV:N...

DEBIAN-CVE-2026-54634

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld sendraw command on TCP port 4532 reaches rigctlsendraw in tests/rigctlparse.c, which writes a NUL byte at bufbuflen + 1 outside its 200-byte stack buffer, and rigsendraw in...

CVE-2026-54633

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...

CVE-2026-54634

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld sendraw command on TCP port 4532 reaches rigctlsendraw in tests/rigctlparse.c, which writes a NUL byte at bufbuflen + 1 outside its 200-byte stack buffer, and rigsendraw in...

CVE-2026-54633

PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine in src/podofo/main/PdfColorSpaceFilter.cpp. PODOFOINVARIANT does not perform a...

UBUNTU-CVE-2026-54634

Hamlib is a ham radio control library for radios, rotators, and amplifiers. Prior to 4.7.2, the unauthenticated rigctld sendraw command on TCP port 4532 reaches rigctlsendraw in tests/rigctlparse.c, which writes a NUL byte at bufbuflen + 1 outside its 200-byte stack buffer, and rigsendraw in...

CVE-2026-54519

AI Agent Automation (npm package backend, repo vmDeshpande/ai-agent-automation) had missing ownership checks in backend/src/controllers/memory.controller.js. The functions listMemories, deleteMemory, and clearAgentMemory accepted a caller-supplied agentId or memory _id without verifying that the ...