CVE-2026-42499: Creation of Immutable Text Using String Concatenation

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CVE-2026-39836: Undefined Security Weakness

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0...

CVE-2026-39823: Undefined Security Weakness

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS...

CVE-2026-39820: Allocation of Resources Without Limits or Throttling

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...

CVE-2026-37709: Improper Access Control

Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component...

CVE-2025-65122: Uncontrolled Resource Consumption

Regex Denial of Service in youtube-regex npm package through version 1.0.5...

CVE-2026-39826: Undefined Security Weakness

If a trusted template author were to write a...

CVE-2026-42499: Creation of Immutable Text Using String Concatenation

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CVE-2025-63705: Improper Neutralization of Special Elements used in an OS Command

NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js...

CVE-2025-63706: Improper Control of Generation of Code

NPM package next-npm-version1.0.1 is vulnerable to Command injection...

CVE-2026-27415: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affects BEAR: from n/a through 1.1.5...

CVE-2026-25436: Missing Authorization

Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal Elementor Addons: from n/a before 1.7.1053...

CVE-2025-66105: Missing Authorization

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Bus Ticket Booking with Seat Reservation: from n/a before 5.6.8...

CVE-2026-5791: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross Site Request Forgery. This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2...

CVE-2026-33814: Loop with Unreachable Exit Condition

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

CVE-2024-43384: Improper Removal of Sensitive Information Before Storage or Transfer

A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer...

CVE-2026-39823: Undefined Security Weakness

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS...

CVE-2026-39836: Undefined Security Weakness

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0...

CVE-2026-39820: Allocation of Resources Without Limits or Throttling

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...

Linux Distros Unpatched Vulnerability : CVE-2026-7963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to...