CVE-2026-8595: Improper Neutralization of Input During Web Page Generation

A user with Editor permissions can craft a dashboard whose table TableNG panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard stored cross-site scripting...

CVE-2026-41878: Authorization Bypass Through User-Controlled Key

R-SOFT DMS is vulnerable to Insecure Direct Object Reference IDOR attack in multiple file download endpoints. The application fetches files from the database by ID and serves them to whoever requests them, relying only on session authentication, meaning any valid user can access any file. This...

CVE-2026-15378: Server-Side Request Forgery (SSRF)

A flaw was found in the guardrails-detectors component. This vulnerability allows a remote attacker to perform a blind Server-Side Request Forgery SSRF by submitting a specially crafted XML Schema Definition XSD string. This can lead to unauthorized access to sensitive information, including...

CVE-2026-21051: Undefined Security Weakness

Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows local attackers to configure TencentWifiSecurity settings...

CVE-2026-21039: Undefined Security Weakness

Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings...

PT-2026-61812

Summary CredSweeper's deep scanner does not enforce recursive limit size as a hard limit. Several recursive scanners fully decompress or fully read attacker-controlled content before the remaining budget is validated, and AbstractScanner.recursive scan continues processing even when the residual...

CVE-2026-11914: Improper Input Validation

vulnerability in Drupal Composer allows . This issue affects Composer versions:...

CVE-2026-2397: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection. This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not...

dltkai (>=1.0.11, <=1.1.0), eyegrade (>=0.8.0rc1, <=0.8.1) +6 more potentially affected by CVE-2019-19624 via opencv-python (4.0.0.21)

opencv-python PYPI version 4.0.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on opencv-python and may be impacted: - dltkai =1.0.11, =0.8.0rc1, =0.0.4, =1.0.4, =0.0.2, =1.0.22, =1.0.28.3 Source cves: CVE-2019-19624 Source advisory: OSV:PYSEC-2026-2...

Wordfence Intelligence Weekly WordPress Vulnerability Report (June 29, 2026 to July 5, 2026)

Last week, there were 289 vulnerabilities disclosed in 205 WordPress Plugins and 41 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 130 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...

CVE-2025-45422: Improper Access Control

Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding rules...

CVE-2026-15308: Uncontrolled Resource Consumption

The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data...

CVE-2026-4256: Improper Neutralization of Special Elements used in an LDAP Query

Improper neutralization of special elements used in an LDAP query 'LDAP injection' vulnerability in PEAKUP Technology Inc. PassGate allows LDAP Injection. This issue affects PassGate: through 30042026...

CVE-2026-58303: Stack-based Buffer Overflow

Stack-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: before b30b63fc63b403907d8137da1c65aaa4521fe74e...

CVE-2026-5955: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Inrove Software and Internet Services BiEticaret allows SQL Injection. This issue affects BiEticaret: before v3.3.57...

CVE-2026-31984: Allocation of Resources Without Limits or Throttling

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into...

CVE-2026-31982: URL Redirection to Untrusted Site

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who...

CVE-2026-31983: Missing Authentication for Critical Function

A Missing Authentication vulnerability was discovered in the SSH keys synchronization endpoint. An unauthenticated attacker can send a request to the SSH keys synchronization endpoint and obtain the list of users that have uploaded their public SSH keys, their groups, and the uploaded public SSH...

Linux Distros Unpatched Vulnerability : CVE-2026-13151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain...

openSUSE 16: clamav / clamav-devel / clamav-milter / libclamav12 / etc (openSUSE-SU-2026:21252-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21252-1 advisory. Update to version 1.5.3. Security issues fixed: - CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files...