EUVD-2021-34859

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service...

PT-2026-65402

The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch custom field function in admin/class-admin-base.php retrieving the widget id POST parameter via filter inputINPUT POST, ... and directly...

PT-2026-65430

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access witho...

PT-2026-65528

IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it...

PT-2026-65619

Name of the Vulnerable Software and Affected Versions openhole versions prior to 0.1.2 Description The openhole-server in internal/server/public proxy.go forwarded the URL-decoded request path r.URL.Path to tunnel clients instead of preserving the original request target. This behavior allowed...

PT-2026-65538

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumertoken request parses the raw Location header of a 300 to 399 redirect returned by the OAuth server and follows the redirect recursively, which can mutate the consumer's...

Kibana 9.4.x < 9.4.3 Multiple Vulnerabilities (ESA-2026-54 / ESA-2026-58)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.3. It is, therefore, affected by multiple vulnerabilities as referenced in the ESA-2026-54 and ESA-2026-58 advisories. - Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics...

Linux Distros Unpatched Vulnerability : CVE-2026-17512

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in ggml-org whisper.cpp 1.8.4-58. This impacts the function logmelspectrogram of the file src/whisper.cpp. The manipulation leads...

PT-2026-65549

Name of the Vulnerable Software and Affected Versions terraform-mcp-server versions prior to 1.1.0 Description A server-side request forgery SSRF issue exists in the streamable-HTTP transport. This allows an unauthenticated remote client to redirect the server's Terraform API requests and the...

PT-2026-65389

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

Multiple Node.js vulnerabilities identified in Brocade SANnav (CVE-2025-55131, CVE-2025-55132, CVE-2025-59464, CVE-2025-59465, CVE-2025-59466, CVE-2026-21636, CVE-2026-21637, CVE-2025-55130)

Multiple Node.js vulnerabilities in Brocade SANnav Products. CVE-2025-59465. A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of safely closing the connection, the process crashes, enablin...

WordPress WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action vulnerability

Unauthenticated Sensitive Information Exposure in 'wpbotsendemailtranscript' AJAX Action vulnerability discovered by Wordfence PRISM in WordPress Plugin ChatBot versions = 8.5.9...

CVE-2026-51078

An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...

CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

CVE-2026-64732

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.7. An attacker with physical access may be able to access sensitive user data during iPhone Mirroring...

CVE-2026-43753

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information...

CVE-2026-43753

The CVE-2026-43753 issue is an out-of-bounds read fixed by Apple in iOS 26.6/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The root cause is improved bounds checking; exploitation would require physical access to a locked device and could reveal sensitive user data...

CVE-2026-64732

CVE-2026-64732 affects Apple iOS/iPadOS where an attacker with physical access could access sensitive user data during iPhone Mirroring. The issue was resolved by improved state management and is fixed in iOS 26.6 and iPadOS 26.6. Connected advisories corroborate that core Apple components addres...

CVE-2026-64732

This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6. An attacker with physical access may be able to access sensitive user data during iPhone Mirroring...

EUVD-2026-49469

This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data...