CVE-2026-52520: Improper Neutralization of Input During Web Page Generation

Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...

EUVD-2026-52484

Emlog CMS = 2.6.14 contains a stored cross-site scripting XSS vulnerability in the article publishing module /admin/article.php. A remote authenticated attacker can inject arbitrary JavaScript code via the article content. When an administrator reviews or previews the submitted article in the...

CVE-2026-52102

An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters...

CVE-2026-52520

Emlog CMS versions

ROS-20260803-73-0002

The vulnerability of the RedisBloom data structure module of the Redis database management system is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-67413

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attackers to read forum topics and posts by...

CVE-2026-61524: Unrestricted Upload of File with Dangerous Type

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature that allows authenticated administrators to achieve remote code execution by uploading a crafted ZIP archive containing a PHP webshell alongside a valid info.php metadata file...

ALSA-2026:49668 Moderate: p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS11 modules. The p11-kit-trust subpackage includes a PKCS11 trust module that provides certificate anchors and black lists based on configuration files. Security Fixes: p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing...

CVE-2026-18585: Heap-based Buffer Overflow

A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.getfilelist of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer...

CVE-2026-64450

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. A remote TIPC neighbor can send a specially crafted broadcast message containing a malformed Gap ACK blocks record. This vulnerability occurs because the system fails to properly validate the record's...

CVE-2026-64339

A flaw was found in the Linux kernel's USB subsystem, specifically within the usbio module. A malicious or malfunctioning Universal Serial Bus USB device can exploit this vulnerability by providing crafted input during a bulk IN transfer. This can lead to an out-of-bounds read, allowing the devic...

MINI-VPWR-825V-6M8X

Bulletin has no description...

CVE-2026-18536

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...

UBUNTU-CVE-2026-18536

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...

Arbitrary Code Injection

Overview sentence-transformers is a State-of-the-Art Text Embeddings Affected versions of this package are vulnerable to Arbitrary Code Injection through the importmoduleclass function in sentencetransformers/util/misc.py due to a logic flaw that allows the security guard to be bypassed if a loca...

CVE-2026-9044

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...

CVE-2026-9044 Command Injection Vulnerability in OpenVPN of TP-Link Archer AXE75

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...

CVE-2026-68770

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

CVE-2026-50986

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

CVE-2026-68770 sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...