CVE-2026-68493

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...

CLEANSTART-2026-TM64317 Redis is an open source, in-memory database that persists on disk

Multiple security vulnerabilities affect the redis package. Redis is an open source, in-memory database that persists on disk. See references for individual vulnerability details...

EUVD-2026-82623

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...

CVE-2026-68493

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of...

EUVD-2026-82616

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

CVE-2024-56344: Use of a Broken or Risky Cryptographic Algorithm

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using...

CVE-2026-81810: Improper Privilege Management

The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site...

CVE-2026-93761: Inefficient Regular Expression Complexity

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query...

CVE-2026-17586: Improper Neutralization of Input During Web Page Generation

The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnitctaimgposition' Post Meta in all versions up to, and including, 9.118.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-18317: Missing Authorization

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

CVE-2026-92554: Improper Neutralization of Input During Web Page Generation

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-36421: Cleartext Transmission of Sensitive Information

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques...

Linux Distros Unpatched Vulnerability : CVE-2026-93394

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in libmongoc's SCRAM authentication implementation caused the client to continue the authentication handshake and transmit the client proof even when a...

PT-2026-95289

Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit versions prior to 9.118.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs vi...

PT-2026-95232

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup WordPress plugin versions prior to 7.111 Description Several AJAX actions do not perform proper capability checks and are instead protected by an installation-wide secret. This secret is disclosed to any user...

CVE-2026-40539: Improper Certificate Validation

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary files and conduct denial-of-service attacks...

EulerOS Virtualization 2.12.0 : curl (EulerOS-SA-2026-3634)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check...

EulerOS Virtualization 2.12.1 : curl (EulerOS-SA-2026-3580)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check...

PT-2026-95268

Name of the Vulnerable Software and Affected Versions Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress versions prior to 2.5.4 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform...

PT-2026-95560

Name of the Vulnerable Software and Affected Versions Mongoid affected versions not specified Description An inefficient regular expression complexity issue exists in the in-memory query evaluation component. This allows an unauthenticated party to cause excessive processing within an embedding...