CVE-2026-27875 Simplex Incident Manager Clear Test

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...

CVE-2026-75933

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

CVE-2026-75933

Jet Admin is vulnerable to a stored cross-site scripting (XSS) flaw in the sign-in page's scripts and styles option. An authenticated attacker can inject arbitrary JavaScript that executes in the context of any visiting user's domain, enabling session hijacking, data exfiltration, or further comp...

CVE-2026-75933 Jet Admin Stored XSS

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

EUVD-2026-63998

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

CVE-2026-75933 Jet Admin Stored XSS

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet

Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad...

Jet Admin Cloud Platform multiple vulnerabilities

RISK EVALUATION Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the...

CVE-2026-77806

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel...

CVE-2026-77806

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel...

EUVD-2026-63948

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request header that is mishandled by analyseresultatskel...

CVE-2026-59780

Apache CloudStack is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in its LDAP authentication plugin . The root cause is that the listLdapConfigurations API allows any authenticated user to list LDAP configurations; by default, this API is accessible to all default role...

Multiple SEIKO EPSON printers and scanners keep already revoked root certificates

Overview Multiple printers and scanners provided by SEIKO EPSON CORPORATION contain the following vulnerability. Remaining revoked root certificates CWE-296 - CVE-2026-73542 Agni Athreya, CyberArch Student Researcher of Carl Vinson Institute of Government at University of Georgia reported this...

Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution

Update: The story was updated after publication to note that the vulnerability has not been exploited. Although the security bulletin originally marked the "Exploited" field under the Exploitability Assessment table as "Yes," on August 21, 2026, Microsoft corrected the "Exploited" status to "No"...

CVE-2026-75933: Improper Neutralization of Input During Web Page Generation

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

PT-2026-79399

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

CVE-2026-53572: Improper Neutralization of Special Elements in Output Used by a Downstream Component

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

DEBIAN-CVE-2026-77647

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...

CVE-2026-77647

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...

DEBIAN-CVE-2026-77638

Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle impersonate the onion service that the client was trying to reach...