CVE-2026-74001: Authentication Bypass Using an Alternate Path or Channel

Unauthenticated Broken Authentication in User Registration & Membership Pro = 5.4.5 versions...

CVE-2026-66595: Missing Authorization

Unauthenticated Broken Access Control in WP Data Access = 5.5.80 versions...

CVE-2026-14947: Path Traversal: '../filedir'

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of...

CVE-2026-17160: Integer Overflow or Wraparound

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to an integer overflow during size computation...

CVE-2026-14948: Insertion of Sensitive Information into Log File

A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives...

CVE-2026-18286: Improper Control of Generation of Code

Aeon loadhumanactivitysegmentationdatasets Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2026-18287: Improper Control of Generation of Code

Aeon loadtimeseriessegmentationbenchmark Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of aeon. User interaction is required to exploit this vulnerability in that the target must visit a malicious...

CVE-2026-66604: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

CVE-2026-66600: Unrestricted Upload of File with Dangerous Type

Author Arbitrary File Upload in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66607: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...

CVE-2026-66649: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Directory Pro = 2.5.8 versions...

Linux Distros Unpatched Vulnerability : CVE-2026-71114

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable...

CVE-2026-14950: Insufficient Session Expiration

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

AlmaLinux 8 : gstreamer1-plugins-good (ALSA-2026:56966)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:56966 advisory. gst-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders CVE-2026-18649 gstreamer1-plugins-good:...

Linux Distros Unpatched Vulnerability : CVE-2026-64783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS...

CVE-2026-76372

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

CVE-2026-76372 Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

CVE-2026-76372

CVE-2026-76372 affects the Nmap Scanner connector for Splunk SOAR in versions below 3.0.15 . The root cause is an incorrect permission classification: the connector's action manifest marks the scan network action as read-only , yet the action accepts Nmap Scripting Engine (NSE) script parameters ...

CVE-2026-76372 Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...

CVE-2026-68560

Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...