CVE-2026-74002: Missing Authorization

Unauthenticated Broken Access Control in Booking Calendar = 11.7 versions...

Delphi Scanner: Efficient and Interpretable Static Malware Detection Via API Sequence Modeling

Static malware detection for Windows Portable Executable files demands a careful balance between detection effectiveness, computational efficiency, and analytical interpretability. This paper introduces Delphi Scanner, a static malware detection system for Windows PE files that balances efficienc...

CVE-2026-25283: Stack-based Buffer Overflow

Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size...

CVE-2026-92758: Insertion of Sensitive Information into Log File

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...

CVE-2026-90319: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport-net when rioaddnet fails rioallocnet stores the newly allocated rionet in mport-net before rioscanallocnet registers the device. If rioaddnet fails, rioscanallocnet drops the device reference with putdevice,...

CVE-2026-14850: Weak Password Recovery Mechanism for Forgotten Password

The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the userid parameter. An attacker can manipulate this predictable numeric identifier to reset passwords for arbitrary users without proving account ownership...

CVE-2026-24081: Buffer Over-read

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled...

CVE-2026-92919: Improper Limitation of a Pathname to a Restricted Directory

admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite...

CVE-2026-78295: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Xagio SEO = 7.1.0.43 versions...

CVE-2026-66676: Missing Authorization

Unauthenticated Broken Access Control in Easy Invoice = 2.3.8 versions...

CVE-2026-66624: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WPMasterToolKit = 2.22.0 versions...

CVE-2026-24075: Buffer Over-read

Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper synchronization and race conditions...

CVE-2026-25281: Allocation of Resources Without Limits or Throttling

Transient DOS when processing large or numerous request buffers without sufficient memory allocation validation...

CVE-2026-78294: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Geo Mashup = 1.13.21 versions...

CVE-2026-25275: Buffer Over-read

Transient DOS when processing authentication frames with invalid FILS information element header lengths...

CVE-2026-25294: Buffer Over-read

Transient DOS while parsing frame during channel usage...

CVE-2026-92921: Use of Password Hash With Insufficient Computational Effort

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort...

CVE-2026-25282: Out-of-bounds Read

Transient DOS when processing unverified data from a neighboring system causes out of bound memory access...

CVE-2026-92770

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...