CVE-2026-46428

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

CVE-2026-46428 lettre has TLS hostname verification disabled when using Boring TLS backend

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default strict configuration. An on-path attacker presenting any chain-valid...

CVE-2026-16247

In connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to...

CVE-2026-10755

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

CVE-2026-10755

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

CVE-2026-10755

The CVE-2026-10755 entry concerns the All in One SEO WordPress plugin (pre-4.9.9). The issue is improper access control on AI integration REST API endpoints, allowing low-privilege users (e.g., Contributors) to overwrite or reset the site-wide AI integration state. This is caused by insufficient ...

CVE-2026-10755 All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

Linux Distros Unpatched Vulnerability : CVE-2026-63888

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: target: iscsi: Fix CRC overread and double-free in iscsithandletextcmd Two latent bugs in the Text-phase handler, both present since the original LIO...

EUVD-2026-45433

A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file backend/crm/src/main/java/cn/cordys/crm/system/service/IntegrationConfigService.java of the component Third Party Edit Endpoint. Executing a manipulation of the argument appSecret...

CVE-2026-16223

1Panel-dev CordysCRM up to 1.4.1 is affected in the Third Party Edit Endpoint, specifically the IntegrationConfigService.getSqlBotSrc function. A manipulated appSecret can trigger server-side request forgery (SSRF) and the issue can be exploited remotely. The exploit has been publicly disclosed a...

FLOCK_CVE_SCANNER

FLOCKCVESCANNER Scan and exploit with permission Ov...

MGASA-2026-0257 Updated nodejs packages fix security vulnerabilities

lib,test: redact proxy credentials in tunnel errors. CVE-2026-48615 permission: handle process.chdir on writereport. CVE-2026-48617 tls: normalize hostname for server identity checks. CVE-2026-48618 http2: cap originSet size to prevent unbounded memory growth. CVE-2026-48619 tls: fix case-sensiti...

Updated nodejs packages fix security vulnerabilities

lib,test: redact proxy credentials in tunnel errors. CVE-2026-48615 permission: handle process.chdir on writereport. CVE-2026-48617 tls: normalize hostname for server identity checks. CVE-2026-48618 http2: cap originSet size to prevent unbounded memory growth. CVE-2026-48619 tls: fix case-sensiti...

CVE-2026-9734 W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2026-9734

The CVE-2026-9734 entry concerns the W3SC Elementor to Zoho CRM plugin for WordPress. A CSRF vulnerability exists in all versions up to 2.2.0 due to missing or incorrect nonce validation in the storeInfo function, enabling unauthenticated attackers to alter Zoho CRM integration settings by forgin...

EUVD-2026-45354

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2026-9734

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

[SECURITY] Fedora 44 Update: proftpd-1.3.9c-1.fc44

ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based...

PT-2026-60920

Name of the Vulnerable Software and Affected Versions W3SC Elementor to Zoho CRM versions prior to 2.2.1 Description The plugin is subject to Cross-Site Request Forgery CSRF, a flaw where an attacker tricks a victim into performing actions they did not intend to do. This occurs due to missing or...

GHSA-PGWW-W46G-26QG AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass

Summary The HTML specification requires that a MathML element with encoding="text/html" or encoding="application/xhtml+xml" is treated as an HTML integration point. Content inside it must be parsed as HTML, not MathML. AngleSharp does not implement this correctly. As a result, the parser produces...