CVE-2026-82393

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name...

CVE-2026-82395 Sulu: Media move/update authorization bypass (IDOR)

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...

CVE-2026-81762

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

CVE-2026-81891 elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...

EUVD-2026-68786

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

CVE-2026-81762 WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

CVE-2026-81762

CVE-2026-81762 is a Broken Access Control vulnerability in the Booking and Rental Manager WordPress plugin (for WooCommerce), affecting versions 2.7.6 and earlier . The flaw allows users with the Subscriber role to perform actions they should not be permitted to, resulting in a High integrity imp...

ROOT-APP-NPM-CVE-2026-49458 CVE-2026-49458 in dompurify - Patched by Root

Root has patched CVE-2026-49458 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41239 CVE-2026-41239 in dompurify - Patched by Root

Root has patched CVE-2026-41239 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-1526 CVE-2026-1526 in undici - Patched by Root

Root has patched CVE-2026-1526 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-25883 CVE-2022-25883 in semver - Patched by Root

Root has patched CVE-2022-25883 in the semver package for Root:npm. Multiple fixed versions available...

EUVD-2026-68359

A vulnerability was identified in Systerel S2OPC up to 1.7.3. The impacted element is the function monitoreditemeventfiltertreatmentbsiniteventfilterctxandresult of the file src/ClientServer/services/bgenc/subscriptionmgr.c. Such manipulation of the argument EventFilter leads to use after free. T...

PT-2026-84011

Subscriber Broken Access Control in Booking and Rental Manager = 2.7.6 versions...

The vulnerability of the Password Manager components in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the Password Manager components in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability could allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the Password Manager components in Google Chrome and Microsoft Edge web browsers allows attackers to compromise data integrity.

The vulnerability of the Password Manager component in Google Chrome and Microsoft Edge browsers is related to insufficient validation of entered data. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...

The vulnerability of the Password Manager component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Password Manager component in Google Chrome and Microsoft Edge is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to cause a service failure through a specially created HTML page...

The vulnerability of the Password Manager components in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the Password Manager component in Google Chrome and Microsoft Edge relates to insufficient validation of entered data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the pqm_update_queue_properties() function in the drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c file of the Direct Rendering Infrastructure (DRI) driver for AMD kernel-based Linux operating systems allows a attacker to compromise the accessibility of protected information.

The vulnerability of the pqmupdatequeueproperties function in the drivers/gpu/drm/amd/amdkfd/kfdprocessqueuemanager.c file of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems leads to unmanageable resource consumption. Exploiting this vulnerability...

The vulnerability of the Password Manager components in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the Password Manager components in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential data through a specially create...

VulnCheck KEV: CVE-2026-18366

The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any...