PT-2026-54366

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.47 Description A use after free issue in DevTools allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. Use after free is a memory corruption flaw...

WorksPad Access Control Arbitrary Action

The vulnerability of the EMM solution WorksPad is related to access control errors. Exploiting this vulnerability allows a remote attacker to perform arbitrary actions...

GitLab Enterprise Edition XSS

The vulnerability of monitoring panels in the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripti...

Microsoft Partner Center Hypertext Link Error

The vulnerability of the Microsoft Partner Center software is related to errors in processing hypertext links. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks remotely...

.NET Loop Exit Condition DoS

The vulnerability of the .NET software platform lies in the execution of a loop with an exit condition that is not met. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Cordon multi-purpose photoreceiver family Command Execution

The vulnerability of the Cordon multi-purpose photoreceiver family is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability can allow a remote-operating intruder to execute arbitrary commands...

Kordon Path Traversal

The vulnerability of the Cordon multi-purpose photodetection systems is related to an incorrect limitation on the name of the path to the catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to read arbitrary files...

CVE-2026-2515

The Hostinger Reach plugin for WordPress (v

ExploitBench: A Capability Ladder Benchmark for LLM Cybersecurity Agents

Exploitation is not a binary event. It is a ladder of acquiring progressive capabilities, from executing a single buggy line of code to taking full control of the target. However, existing LLM security benchmarks treat a crash as exploitation success. That single binary outcome collapses the hard...

Cisco Catalyst SD-WAN Manager XSS

The vulnerability in the web interface of the Cisco Catalyst SD-WAN Manager relates to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

TCP/IP driver Windows Bypass Security Restrictions

The vulnerability of the TCP/IP driver for Windows operating systems relates to bypassing authentication using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions remotely...

GHSA-WMM3-H9QJ-P5V6 SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

Summary Changing a user’s password does not invalidate existing sessions, allowing an attacker with a stolen cookie to retain access even after the victim resets their password. Details SillyTavern relies on cookie-session for authentication, storing all session data user handle, permissions in a...

EUVD-2026-29806

Stack-based buffer overflow vulnerabilities exist in several underlying management service components accessed through the command-line interface of the AOS-8 and AOS-10 Operating Systems. An authenticated attacker with administrative privileges could exploit these vulnerabilities by sending...

CVE-2026-8319

A weakness has been identified in aiwaves-cn agents up to e8c4e3c2d19739d3dff59e577d1c97090cc15f59. Affected by this issue is the function recallrelevantmemoriestoworkingmemory of the file core/cat/lookingglass/straycat.py of the component cheshirecatcore. This manipulation causes resource...

CVE-2026-34688 CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials versions [email protected], c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service...

EUVD-2026-29593

Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally...

wafuzz

wafuzz — Web Pentesting Orchestrator Interactive CLI web secu...

uriparser: uriparser: Data integrity issue due to pointer truncation

A flaw was found in uriparser. This vulnerability involves pointer difference truncation, where calculations involving memory addresses are incorrectly shortened. This could lead to minor data integrity issues within the application. Exploitation of this flaw requires local access to the system a...

CVE-2026-8289

A vulnerability was identified in Open5GS up to 2.7.7. This vulnerability affects the function smfnsmfhandleupdatedatainvsmf of the file /src/smf/nsmf-handler.c of the component SMF. The manipulation of the argument qosFlowProfile leads to denial of service. Remote exploitation of the attack is...

EUVD-2026-29450

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aman Ninja Forms Views Display & Edit Ninja Forms Submissions on your site frontend views-for-ninja-forms allows Blind SQL Injection.This issue affects Ninja Forms Views Display & Edit Ninja Forms...