CVE-2026-79393

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary cod...

CVE-2026-62139

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

CVE-2026-62133

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-81910 Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values

Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection SSTI in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and...

CVE-2026-62139 WordPress Site Kit by Google plugin <= 1.186.0 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...

CVE-2026-62133 WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability

Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to server-side request forgery due to axios ( CVE-2025-62718 )

Summary Potential vulnerabilities in axios package CVE-2025-62718 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not...

SUSE CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

SUSE CVE-2026-88015

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, backend/local with --links or links=true exposes symlink targets as .rclonelink objects, and fs.RangeOption.Decode can pass an unchecked positive Range start through...

SUSE CVE-2026-89044

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding...

CVE-2026-89262

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UI...

Exploit for CVE-2026-85612

CVE-2026-85612 CVE-2026-85612https://vulners.com/cve/CVE-20...

Vulnerabilities Affecting SICK CorivaEngine

SICK CorivaEngine includes the third-party components Netty and Spring Cloud Gateway that are affected by multiple known vulnerabilities. Under certain conditions, these vulnerabilities could allow remote attackers to perform HTTP request smuggling, cause resource exhaustion, or manipulate...

CVE-2026-89264

MoguBlog through 6.2 is vulnerable to comment author spoofing in the POST /web/comment/add endpoint. The server fails to validate that the userUid supplied in the request body matches the authenticated session, allowing any authenticated user to post comments attributed to any other account, incl...

CVE-2026-89264 MoguBlog through 6.2 Comment Author Spoofing via Request-Body Identity

MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attributed to any other user. Attackers can supply arbitrary userUid values in the request body to impersonate other accounts including...

CVE-2026-89262

MoguBlog through 6.2 contains an authorization bypass (IDOR) in its comment deletion endpoint. The root cause is that ownership checks are performed against request-body fields rather than the authenticated principal, allowing an unauthenticated attacker to delete arbitrary comments and their rep...

CVE-2026-89262 MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UI...

CVE-2026-89262 MoguBlog through 6.2 Arbitrary Comment Deletion via Request-Body Ownership Check

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UI...

CVE-2026-89245 WWBN AVideo Cross-Site Request Forgery via playlistRemove.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.php that allows attackers to delete playlists by skipping CSRF protection checks. Attackers can craft a malicious form that submits a POST request to...