CVE-2026-97626: Exposure of Sensitive Information to an Unauthorized Actor

Requesting a user or organization profile page GET /username with an Accept: application/rss+xml or Accept: application/atom+xml header returned the owner's activity feed without the visibility check that the profile page and the .rss and .atom routes apply. Anonymous users, restricted users and...

CVE-2026-39748: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in EduMall = 4.5.3 versions...

CVE-2026-39729: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Edwiser Bridge = 4.3.4 versions...

CVE-2026-39728: Server-Side Request Forgery (SSRF)

Unauthenticated Server Side Request Forgery SSRF in Instapage Plugin = 3.7.2 versions...

CVE-2026-57537: Use After Free

Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization...

CVE-2026-57559: Use After Free

Memory corruption while processing service requests...

CVE-2026-105061: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Mailster = 1.9.0.0 versions...

CVE-2026-25433: Missing Authorization

Subscriber Broken Access Control in WP2LEADS = 3.5.7 versions...

CVE-2026-41561: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Museder RestoreOne = 2.7.276 versions...

CVE-2026-42634: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Video Background Block – Use video as background in the section. = 2.0.3 versions...

CVE-2026-104394: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Charitable = 1.8.12.3 versions...

CVE-2026-0198: Missing Authorization

In ispdallowed of gemmsg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-98340: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, cfg80211bssupdate looks for an existing entry with the same BSSID and a hidden zero-length or NUL-filled SSID, and if ...

CVE-2026-57545: Untrusted Pointer Dereference

Memory corruption when processing draw objects of incorrect type during graphics command list execution...

CVE-2026-101156: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful...

CVE-2026-25263: Out-of-bounds Write

Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters...

CVE-2026-39784: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Hotel Booking = 3.8 versions...

CVE-2026-101151: URL Redirection to Untrusted Site

Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process...

Karma Pro 0.14

Karma Pro is an open source code review tool written in Swift that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner AST base and Heuristics that statically analyses projects in multiple languages. It's backed by an ML classifier trained...

CVE-2026-66666: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6...