CVE-2026-17272: Out-of-bounds Write

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a buffer overflow...

CVE-2026-66657: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Biagiotti Core = 2.1.1 versions...

CVE-2026-19292: Authentication Bypass by Primary Weakness

Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below...

CVE-2026-17004: Loop with Unreachable Exit Condition

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop...

CVE-2026-66689: Missing Authorization

Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker = 2.0.0 versions...

CVE-2026-61979: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in SAML SP Single Sign On = 5.4.3 versions...

CVE-2026-58439: Improper Access Control

Branch Protection Bypass via PR Retargeting Preserves Stale official Approval Flag...

CVE-2026-27380: Deserialization of Untrusted Data

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-11840: Improper Neutralization of Special Elements used in an SQL Command

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

CVE-2026-17069: Cross-Site Request Forgery (CSRF)

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of anti-CSRF tokens...

CVE-2026-66653: Improper Control of Filename for Include/Require Statement in PHP Program

Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...

CVE-2026-66472: Improper Neutralization of Special Elements used in an SQL Command

Unauthenticated SQL Injection in Everest Backup = 2.3.12 versions...

CVE-2026-61984: Missing Authorization

Unauthenticated Broken Access Control in WPMobile.App = 11.77 versions...

CVE-2026-73349: Missing Authorization

Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...

CVE-2026-28174: Insertion of Sensitive Information Into Sent Data

Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...

CVE-2026-28173: Missing Authorization

Customer Arbitrary Content Deletion in WP Event SOlution = 4.1.19 versions...

CVE-2026-66446: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in If-So Dynamic Content Personalization = 1.10 versions...

CVE-2026-58441: Server-Side Request Forgery (SSRF)

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

CVE-2026-16853: Out-of-bounds Read

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read...

CVE-2026-42931: Allocation of Resources Without Limits or Throttling

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...