CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

WordPress Create Block Theme plugin < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite) vulnerability

Admin+ PHP Code Injection via Pattern Save Multisite vulnerability discovered by Pavan Saxena Rootkid in WordPress Plugin Create Block Theme versions 2.10.0...

CVE-2026-37067: Improper Access Control

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

PT-2026-82670

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-37067

Incorrect access control in /vfm-admin/admin-panel/view/save-cvs.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to extract all application logs from a desired date forwards via a specially crafted POST request...

CVE-2026-81931: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

CVE-2026-37067

An incorrect access control vulnerability exists in the Veno File Manager Project 4.4.9 within the /vfm-admin/admin-panel/view/save-cvs.php component. This flaw allows an unauthenticated attacker to extract all application logs from a specific date onwards by sending a specially crafted POST requ...

SUSE CVE-2026-68469

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENTSLEEP -...

PT-2026-82050

Arbitrary file overwrite via SAVE PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

EUVD-2026-65314

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

CVE-2026-18323 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

PT-2026-81164

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em options save function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: State corruption has been prevented in fpurestoresig. The non-compacted slowpath uses copyfromuser to copy the entire user buffer into the kernel buffer, verbatim. This means that the kernel buffer may now contain entire...

CVE-2026-30865

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30865 Combodo iTop: Reflected XSS in dashboard save

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30865 Combodo iTop: Reflected XSS in dashboard save

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

EUVD-2026-64147

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30865

Combodo iTop , a web-based IT service management tool, is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality . The flaw allows an attacker to craft a malicious URL that, when clicked by a victim, executes arbitrary script in the victim's browser c...

CVE-2026-30865 Combodo iTop: Reflected XSS in dashboard save

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...