CVE-2026-78662: Allocation of Resources Without Limits or Throttling

Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time,...

CVE-2025-15490: Incorrect Authorization

The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protection offered via crafted URLs...

CVE-2026-84775: Allocation of Resources Without Limits or Throttling

Unauthenticated Denial of Service Attack in Really Simple SSL = 9.8.0 versions...

CVE-2026-82223: Missing Authorization

Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...

CVE-2026-19117: Authentication Bypass by Spoofing

Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user. This issue affects on-premises deployments only...

CVE-2025-46418: Improper Neutralization of Special Elements used in an OS Command

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition...

CVE-2024-35585: Missing Authentication for Critical Function

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...

CVE-2026-84780: Allocation of Resources Without Limits or Throttling

Unauthenticated Denial of Service Attack in WP Go Maps = 10.1.08 versions...

CVE-2026-81771: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in TrustedSite = 1.2.5 versions...

CVE-2026-81286: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WCFM Marketplace = 3.8.1 versions...

CVE-2026-84772: Server-Side Request Forgery (SSRF)

Editor Server Side Request Forgery SSRF in Broken Link Checker = 2.4.14 versions...

CVE-2026-84760: Missing Authorization

Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce = 3.2.9 versions...

CVE-2026-84759: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in Activity Log = 2.13.1 versions...

CVE-2026-81294: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Authorizer = 3.15.1 versions...

CVE-2026-81289: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in MP3 Audio Player for Music, Radio & Podcast by Sonaar = 5.13.1 versions...

CVE-2025-9314: Unrestricted Upload of File with Dangerous Type

The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component...

CVE-2026-76757: Improper Restriction of Operations within the Bounds of a Memory Buffer

Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...

CVE-2026-20279: Improper Access Control

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

CVE-2026-20275: Incorrect Calculation

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...

CVE-2026-84662: URL Redirection to Untrusted Site

Jenkins LDAP Plugin 807.809.vd3a4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL...