CVE-2026-17481: Improper Output Neutralization for Logs

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs...

CVE-2026-61978: Missing Authorization

Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter Piraeus Bank = 1.0.32 versions...

CVE-2026-28182: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

CVE-2026-17101: Improper Authentication

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication...

CVE-2026-66660: Missing Authorization

Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on = 2.5.1 versions...

CVE-2026-28157: Path Traversal: '.../...//'

Subscriber Path Traversal in Do Lasso = 358 versions...

CVE-2026-58438: Missing Authorization

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access...

CVE-2026-58436: Inefficient Algorithmic Complexity

ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests...

CVE-2026-17206: Out-of-bounds Write

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow...

CVE-2026-16929: Out-of-bounds Write

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a buffer overflow...

CVE-2026-16674: Untrusted Search Path

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path...

CVE-2026-28159: Missing Authorization

Subscriber Broken Access Control in Service Finder Booking = 6.2 versions...

CVE-2026-28002: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-27539: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-27535: Missing Authorization

Subscriber Broken Access Control in Solace Extra = 1.6.0 versions...

CVE-2026-28008: Authentication Bypass by Spoofing

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO OAuth Client = 7.0.0 versions...

CVE-2026-28001: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in WP Directory Kit = 1.5.4 versions...

CVE-2026-18020: Out-of-bounds Read

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an off-by-one error in bounds checking...

CVE-2026-17476: Out-of-bounds Write

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an improper buffer write...

CVE-2026-17226: Out-of-bounds Read

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read...