CVE-2026-89243

WWBN AVideo (through commit c3edcc27) contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name(), which fails to sanitize the group_name input. An administrator holding the canAdminUserGroups permission can inject malicious HTML or JavaScript that executes in the browser ...

ROOT-APP-NPM-CVE-2022-46175 CVE-2022-46175 in json5 - Patched by Root

Root has patched CVE-2022-46175 in the json5 package for Root:npm. Multiple fixed versions available...

PT-2026-90188

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the charger-manager component of the power supply subsystem. The problem occurs because charger manager remove and the err reg extcon probe error path...

CVE-2026-89472: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: charger-manager: register regulators before exposing sysfs chargermanagerremove and the errregextcon probe error path free each charger regulator with regulatorput before tearing down the powersupply sysfs entries...

CVE-2026-68535: Missing Authorization

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate method on submitted data, which, for file-referencing blocks such as heroimage and gallery, is where the referenced file is authorized against the user's file-manager...

ROS-20260911-73-0218

The vulnerability of Google Chrome’s Password Manager component is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to replace the user interface...

ROS-20260911-73-0219

The vulnerability of Google Chrome’s Password Manager component is related to a lack of mechanisms for verifying the source of data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially created HTML pag...

Ivanti Endpoint Manager Mobile < 12.8.0.4 / 12.9.x < 12.9.0.2 / 12.10.0.0 Privilege Escalation (CVE-2026-18851)

The version of Ivanti Endpoint Manager Mobile, formerly MobileIron Core, running on the remote host is prior to 12.8.0.4, or 12.9.x prior to 12.9.0.2. It is, therefore, affected by a privilege escalation vulnerability: - Missing authorization in Ivanti Endpoint Manager Mobile before version...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

CVE-2026-18994

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...

CVE-2026-18994

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...

EUVD-2026-75752

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...

CVE-2026-18994

CVE-2026-18994 is a potential improper authorization vulnerability in the Lenovo File Manager Android Application , which is distributed exclusively in the Chinese market. A local authenticated user could read or modify protected files within the application. Lenovo rates this HIGH severity with ...

CVE-2026-18994

A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...

CVE-2026-89049 Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

CVE-2026-88055

AnythingLLM (by Mintplex-Labs), in versions 1.16.1 and earlier , is affected by a stored XSS caused by unescaped server-side HTML concatenation. The manager role can store meta_page_title or meta_page_favicon via /api/admin/system-preferences; these values pass unchanged through server/models/sys...

CVE-2026-88055 AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store metapagetitle or metapagefavicon through /api/admin/system-preferences, and MetaGenerator inserts those values into...

CVE-2026-68487

Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer...

Security Bulletin: IBM MQ Appliance is affected by an improper authorization vulnerability (CVE-2026-10030)

Summary IBM MQ Appliance has addressed an improper authorization vulnerability that could allow an authenticated attacker to create and start queue managers. Vulnerability Details CVEID:CVE-2026-10030 DESCRIPTION: IBM MQ Console allows authenticated non-administrative users to create and start...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...