CVE-2026-58445: Observable Discrepancy

Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API...

CVE-2026-19695: Stack-based Buffer Overflow

Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service...

CVE-2026-19293: Weak Password Requirements

SMP security request from peripheral does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below...

CVE-2026-55987: Incorrect Authorization

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...

CVE-2026-28168: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in CubeWP = 1.1.30 versions...

CVE-2026-17272: Out-of-bounds Write

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow...

Linux Distros Unpatched Vulnerability : CVE-2026-73499

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a user granted READ permission on a...

CVE-2026-66657: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...

SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2026:3571-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3571-1 advisory. This update for ImageMagick fixes the following issue: - CVE-2026-64685: heap buffer overread in BGR decoder due to...

CVE-2026-19292: Authentication Bypass by Primary Weakness

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below...

CVE-2026-17004: Loop with Unreachable Exit Condition

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop...

CVE-2026-66689: Missing Authorization

Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker = 2.0.0 versions...

CVE-2026-61979: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in SAML SP Single Sign On = 5.4.3 versions...

CVE-2026-58439: Improper Access Control

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-27380: Deserialization of Untrusted Data

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-11840: Improper Neutralization of Special Elements used in an SQL Command

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

CVE-2026-17069: Cross-Site Request Forgery (CSRF)

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-56443: Incorrect Authorization

Token public-only scope bypassed on Limited-visibility owners Repository + Package categories — residual after CVE-2026-25714 / PR 37118...

CVE-2026-66653: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...

CVE-2026-56859: Allocation of Resources Without Limits or Throttling

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...