CVE-2026-59258 immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owne...

CVE-2026-59258 immich < 3.0.3 Shared Album Editor Ownership Takeover via updateUser

immich before 3.0.3 contains a broken access control vulnerability in the PUT /albums/:id/user/:userId endpoint that allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owne...

The vulnerability of the console-based graphic editor ImageMagick, related to insufficient protection of operational data, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the console-based graphic editor ImageMagick is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2026-58534

Heap-based buffer overflow in Microsoft Input Method Editor IME allows an authorized attacker to elevate privileges locally...

CVE-2026-58534 Windows Input Method Editor (IME) Elevation of Privilege Vulnerability

...

CVE-2026-58534

CVE-2026-58534 is a Windows IME heap-based buffer overflow vulnerability that enables local privilege escalation for an authenticated attacker. The affected component is the Microsoft Input Method Editor (IME) in Windows. The root cause, per the available sources, is a heap-based buffer overflow ...

CVE-2026-58534 Windows Input Method Editor (IME) Elevation of Privilege Vulnerability

...

CVE-2026-50520 Visual Studio Code Remote Code Execution Vulnerability

...

Windows Input Method Editor (IME) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Input Method Editor IME allows an authorized attacker to elevate privileges locally...

gegl04 security update

An update is available for gegl04. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list GEGL Generic Graphics Library is a graph-based image processing framework...

CVE-2026-12511

The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal...

CVE-2026-12511

The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal...

CVE-2026-12511 AI Engine < 3.5.5 - Editor+ Arbitrary File Write via Path Traversal

The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal...

CVE-2026-12511

The CVE-2026-12511 issue affects the AI Engine WordPress plugin prior to version 3.5.5, where a user-supplied filename is not sanitized before using it to write a downloaded file. This enables authenticated users with editor-level access to perform path traversal and write attacker-controlled byt...

EUVD-2026-43626

The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downloaded file, allowing authenticated users with editor-level access to write attacker-controlled bytes to an arbitrary location on the server via path traversal...

EulerOS 2.0 SP10 : vim (EulerOS-SA-2026-2718)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tarVimuntar in runtime/autoload/tar.v...

PT-2026-58066

Name of the Vulnerable Software and Affected Versions Easy!Appointments versions prior to 1.6.0 Description An authenticated administrator can execute a stored Cross-Site Scripting XSS attack—a vulnerability where malicious scripts are permanently stored on the target server—by injecting HTML or...

PT-2026-58647

Name of the Vulnerable Software and Affected Versions Microsoft Input Method Editor IME affected versions not specified Description A heap-based buffer overflow occurs in the Microsoft Input Method Editor IME, which is a system component that allows users to input characters for languages that do...

CVE-2026-58487 HedgeDoc: Stored HTML injection via email local-part

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe handling of the local-part of registered email addresses, HedgeDoc was vulnerable to stored HTML Injection through its publish and slide views. An attacker could register a...

CVE-2026-58411

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...