CVE-2026-62385

A flaw was found in NLTK. This path traversal vulnerability, located in the FramenetCorpusReader and NKJPCorpusReader components, allows an attacker to read arbitrary XML files accessible to the application. This can be achieved by supplying unsafe selectors or poisoned index state, exploiting...

CVE-2026-62383

A flaw was found in nltk. A local attacker can exploit a symlink-based vulnerability in the IPIPANCorpusReader methods. By placing a symbolic link in the corpus root directory and invoking specific methods, an attacker can bypass security validation and read arbitrary files accessible to the...

CVE-2026-65642

A flaw was found in Plesk. This vulnerability, known as an Insecure Direct Object Reference IDOR, allows remote authenticated users to bypass authorization checks. An attacker can exploit this to read and modify other customers' databases, leading to unauthorized information disclosure and data...

CVE-2026-80599

A flaw was found in the Linux kernel's batman-adv Better Approach To Mobile Ad-hoc Networking - Advanced module. An attacker, by sending specially crafted network packets, could trigger an out-of-bounds memory access in the batadvgetvid function. This occurs because the function fails to verify t...

CVE-2026-82624

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

CVE-2026-68951

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

CVE-2026-80673

A flaw was found in the Linux kernel's NTFS file system driver. An attacker can craft a malicious on-disk attribute list that, when processed, causes an out-of-bounds read. This occurs because a look-ahead entry in the attribute list is not properly validated, allowing data to be read beyond the...

CVE-2026-68951

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

EUVD-2026-68369

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

CVE-2026-82624 code-projects Simple Inventory System Database Backup File inventorymanagement.sql information disclosure

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

CVE-2026-82624

code-projects Simple Inventory System 1.0 is affected by an information disclosure vulnerability in the file inventorymanagement.sql , within the Database Backup File Handler component. The specific root cause is described as "some unknown functionality" of that file. The flaw is exploitable remo...

EUVD-2026-68368

Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a...

CVE-2026-58574

Dell PowerStore is affected by a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface can read internal system information from the appliance filesystem. This may expose sensitive information and credent...

CVE-2026-19913

A flaw was found in the Kaltura HTML5 player mwEmbed / html5lib. An unauthenticated, remote attacker can exploit improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter, used for backend requests, accepts non-HTTP schemes such as file://. When an exception or error...

CVE-2026-80662

A flaw was found in the Linux kernel's Compute Express Link CXL subsystem. An incorrect definition of the CXLHEADERLOGSIZE led to an out-of-bounds read when processing RAS capability structures. This vulnerability allows a local attacker to read sensitive kernel stack memory, potentially leading ...

CVE-2026-80707

A flaw was found in the Linux kernel's J1939 CAN bus transport module. When a new session's receive buffer is allocated, it is not properly initialized, which can leave residual data from previous memory usage. A local attacker could potentially exploit this to read sensitive information from the...

CVE-2026-80591

A flaw was found in the f2fs file system within the Linux kernel. This vulnerability arises from inadequate validation of extended attribute xattr entries during the f2fslistxattr function's operation. A local attacker could potentially create a corrupted xattr entry, causing the system to attemp...

CVE-2026-79780

A flaw was found in rclone. The application fails to properly sanitize IBM IAM bearer tokens and Server-Side Encryption with Customer-Provided Keys SSE-C encryption keys during S3 redirect callbacks. This allows credentials to be preserved across scheme or host changes. A remote attacker observin...

CVE-2026-82727

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...