PT-2026-29861

Frappe Learning Management System LMS is a learning system that helps users structure their content. From version 2.27.0 to before version 2.48.0, Frappe LMS was vulnerable to stored XSS. This issue has been patched in version 2.48.0...

CVE-2026-32929

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!getmacromemCOM. Opening a crafted V7 file may lead to information disclosure from the affected product...

CVE-2026-32927

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6MemInIF!settemptypedefault. Opening a crafted V7 file may lead to information disclosure from the affected product...

CVE-2026-32929

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!getmacromemCOM. Opening a crafted V7 file may lead to information disclosure from the affected product...

CVE-2026-32929

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read in VS6ComFile!getmacromemCOM. Opening a crafted V7 file may lead to information disclosure from the affected product...

CVE-2026-32927

Summary (concrete details): FUJI Electric V-SFT, versions 6.2.10.0 and earlier, contains an out-of-bounds read in VS6MemInIF!set_temp_type_default. Opening a crafted V7 file may disclose information from the affected product. Affected component is the V-SFT file handling logic (VS6MemInIF and V7 ...

CVE-2026-32926

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!loadlinkinf. Opening a crafted V7 file may lead to information disclosure from the affected product...

CVE-2026-32926

V-SFT versions 6.2.10.0 and prior contain an out-of-bounds read vulnerability in VS6ComFile!loadlinkinf. Opening a crafted V7 file may lead to information disclosure from the affected product...

CVE-2026-34543

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, sensitive information from heap memory may be leaked through the decoded pixel data information disclosure...

CVE-2026-34543

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.8, sensitive information from heap memory may be leaked through the decoded pixel data information disclosure...

CVE-2026-34545

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From version 3.4.0 to before version 3.4.7, an attacker providing a crafted .exr file with HTJ2K compression and a channel width of 32768 can write...

EUVD-2026-17966

A vulnerability was identified in Enter Software Iperius Backup up to 8.7.2. This impacts an unknown function of the file IperiusAccounts.ini. Such manipulation leads to use of hard-coded cryptographic key . The attack must be carried out locally. This attack is characterized by high complexity...

CVE-2026-34220

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to versions 6.6.10 and 7.0.6, there is a SQL injection vulnerability when specially crafted objects are interpreted as raw SQL query fragments. This issue has been patched in versions 6.6....

Minor update for Vivaldi Android Browser 7.9

Head to the Google Play Store and download the browser. Alternatively, you can download Vivaldi from Uptodown, the Android app store. Your rating for our browser matters. ⭐️ ⭐️ ⭐️ ⭐️ ⭐️ Enjoy! Changelog The following is a list of changes since the initial 7.9 stable release: Upgraded to...

CVE-2026-29014

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve...

CVE-2026-29014 MetInfo CMS Unauthenticated PHP Code Injection RCE

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP code. Attackers can exploit insufficient input neutralization in the execution path to achieve...

CLEANSTART-2026-PM79547 Security fixes for CVE-2018-20969, CVE-2018-6952, CVE-2019-13636, CVE-2019-13638, CVE-2019-20633 applied in versions: 2.7.6-r2, 2.7.6-r4, 2.7.6-r5, 2.7.6-r6, 2.7.6-r7

Multiple security vulnerabilities affect the patch package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FN55648 Security fixes for CVE-2025-25285, CVE-2026-21637, ghsa-23c5-xmqv-rm74, ghsa-72xf-g2v4-qvf3, ghsa-7r86-cg39-jmmj, ghsa-fj3w-jwp8-x2g3, ghsa-pfrx-2q88-qq97, ghsa-rc47-6667-2j5j, ghsa-rmvr-2pp2-xj38 applied in versions: 2.6.0-r1, 2.7.0-r0

Multiple security vulnerabilities affect the mongosh package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-3831

The CVE-2026-3831 entry concerns the Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress. A missing capability check in entries_shortcode() affects all versions up to 1.4.9, enabling authenticated users with Contributor-level access and above to access all form submissions ...

CVE-2026-3831 Database for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the entriesshortcode function in all versions up to, and including, 1.4.9. This makes it possible for authenticated attackers, with...