EUVD-2026-52532

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering over a network...

EUVD-2026-52525

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

EUVD-2026-52531

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

CVE-2026-66317

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering over a network...

CVE-2026-66317

Technical details (affected product/components, root cause, impact, or remediation) are not publicly available in the provided documents. Monitor for updates from MSRC/NVD/ENISA EUVD for new information.

CVE-2026-66311

CVE-2026-66311: Microsoft Edge (Chromium-based) Tampering Vulnerability. Local attacker can tamper due to missing authorization. Affects Edge when running Chromium-based builds; CVSSv3.1 base score 6.2 (Medium), confidentiality impact High, no impact to integrity/availability. Remediation: apply ...

CVE-2026-66311

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

CVE-2026-66313

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering locally...

CVE-2026-66313

CVE-2026-66313: A origin validation error in Microsoft Edge (Chromium-based) enables local tampering by an unauthorized attacker. Documents confirm the vulnerability exists but provide no specific exploit details or mitigations; no patch/version is stated in the supplied sources. Remediation stat...

Sequelize: SQL Injection (Oracle DB)

Summary SQL Injection is possible with strings only if dialect is set to oracle. The vulnerability was confirmed on Sequelize v6.37.3. Details The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. javascript else if dialect === 'oracle...

CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

CVE-2026-12259

The CVE affects nltk 3.9.4: nltk.downloader.Downloader._download_package() can write package bytes to disk and may extract them before SHA-256/MD5 checks, enabling tampering via compromised mirrors or proxies. This could lead to installation of attacker-controlled package bytes (potentially malic...

EUVD-2026-52226

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

CVE-2026-12259 Improper Input Validation in nltk/nltk

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

NVIDIA Triton Inference Server <= 26.02 - Authentication Bypass

NVIDIA Triton Inference Server contains an authentication bypass vulnerability, letting attackers bypass authentication and potentially execute code, escalate privileges, tamper data, cause denial of service, or disclose information, exploit requires no special conditions. id: CVE-2026-24207 info...

Spotweb <= 1.5.1 - Cross Site Scripting

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter. id: CVE-2021-40970 info: name: Spotweb = 1.5.1 - Cross Site Scripting author: theamanrawat severity:...

Linux Distros Unpatched Vulnerability : CVE-2026-18536

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and...

CVE-2026-67314

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...

CVE-2026-67314 axios before 1.18.0 Prototype Pollution via auth subfields

axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and lib/helpers/resolveConfig.js. When an application is already affected by a separate prototype-pollution primitive and makes an axios request with an own auth...