BELL-CVE-2026-57075

Bulletin has no description...

CVE-2026-9734

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

CVE-2026-9734

The CVE-2026-9734 entry concerns the W3SC Elementor to Zoho CRM plugin for WordPress. A CSRF vulnerability exists in all versions up to 2.2.0 due to missing or incorrect nonce validation in the storeInfo function, enabling unauthenticated attackers to alter Zoho CRM integration settings by forgin...

CVE-2026-9734

The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incorrect nonce validation on the storeInfo function. This makes it possible for unauthenticated attackers to modify the plugin's...

ECHO-4F01-552E-5103

Bulletin has no description...

ECHO-08B8-A846-66A1

Bulletin has no description...

ECHO-E02F-37FD-99CC

Bulletin has no description...

MINI-36C6-GRJ5-V42G

Bulletin has no description...

MINI-CCV7-FQR8-M55H

Bulletin has no description...

MINI-PGF6-573G-47F5

Bulletin has no description...

MINI-P6H7-HPVQ-VP53

Bulletin has no description...

PT-2026-60935

Name of the Vulnerable Software and Affected Versions @fastify/reply-from versions 8.3.1 through 12.6.3 Description Internal URL cache keys are constructed by concatenating the destination and source paths without a delimiter. This allows different destination and source pairs to generate identic...

Linux Distros Unpatched Vulnerability : CVE-2026-44453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloca...

CVE-2026-55518 Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation

Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach? in the UI and GET /resources/:resource/:id/:related/new path, but the actual write endpoint, POST /resources/:resource/:id/:related, does not run t...

CVE-2026-50197

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the...

MINI-JM5J-98J2-W5GR

Bulletin has no description...

MINI-WQR3-63M9-G2FG

Bulletin has no description...

CVE-2026-50197

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the...

CVE-2026-50197 Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.10, zalando/skipper's OpenPolicyAgent integration silently bypasses request-body inspection on HTTP/1.1 Transfer-Encoding: chunked and HTTP/2 requests that omit the content-length pseudo-header, because the...

CVE-2026-53712

SCRAM Salted Challenge Response Authentication Mechanism is part of the family of Simple Authentication and Security Layer SASL, RFC 4422 authentication mechanisms. Prior to 3.3, a flaw in com.ongres.scram:scram-client and com.ongres.scram:scram-common allows an attacker capable of a TLS...