CVE-2026-5820

The Zypento Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table of Contents block in all versions up to, and including, 1.0.6. This is due to the front-end TOC rendering script reading heading text via innerText and inserting it into the page using innerHTML...

CVE-2026-40542

Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper mutual authentication verification. Users are recommended to upgrade to version 5.6.1, which fixes this issue...

DeepL Chrome browser extension vulnerable to cross-site scripting

Overview DeepL Chrome browser extension contains the following vulnerability. Cross-site scripting CWE-79 - CVE-2026-40451 This vulnerability was reported by the researchers below and JPCERT/CC coordinated with the developer. Junki Yuasa of Cybozu, Inc. reported this vulnerability to JPCERT/CC...

EUVD-2026-24603

The a+HCM developed by aEnrich has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload arbitrary files to any path, including HTML documents, which may result in a XSS-like effect...

CVE-2026-6839

The vulnerability CVE-2026-6839 affects Samsung ONE (Open Source ONE). Root cause: improper validation of STRING tensor offsets during constant tensor import, which can trigger out-of-bounds access. Affected versions are prior to commit 1.30.0. Impact described by CVSS: LOCAL attacker with low at...

EUVD-2026-24605

DeepL Chrome browser extension versions from v1.22.0 to v.1.23.0 contain a cross-site scripting vulnerability, which allows an attacker to execute arbitrary script in a user's browser, and inject malicious HTML into web pages viewed by the user...

CVE-2026-41458

OwnTone Server versions 28.4–29.0 are affected by a race condition in the DAAP login handler that allows unauthenticated attackers to crash the server by flooding the /login endpoint due to unsynchronized access to the global DAAP session list. The CVE record indicates a fix in 29.1; upgrade to 2...

PT-2026-34298

Name of the Vulnerable Software and Affected Versions Sentence To SEO versions prior to 1.1 Description The Sentence To SEO plugin for WordPress contains a Stored Cross-Site Scripting issue. The problem occurs because the plugin fails to properly sanitize input and escape output for the 'Permanen...

VulnCheck KEV: CVE-2024-32114

In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context where the Jolokia JMX REST API and the Message REST API are located. It means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker using Jolokia J...

PT-2026-34371

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.19-rc1 Description A race condition exists between mTHP splitting and the zap nonpresent ptes function on arm64 servers. The issue occurs in the softleaf to folio function due to a missing memory barrier smp rm...

CVE-2026-41667: Integer Overflow or Wraparound

Integer overflow in constant tensor data size calculation in Samsung Open Source ONE could cause incorrect buffer sizing for large constant nodes. Affected version is prior to commit 1.30.0...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-013846)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013846 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinputffuploadcompat to avoid info leak Struct ffeffectcompat is...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013644)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013644 advisory. In the Linux kernel, the following vulnerability has been resolved: sparc: fix accurate exception reporting in copyfromtouser for UltraSPARC III Anthony Yznaga track...

PowerDNS Recursor security vulnerability

PowerDNS Recursor pdnsrecursor is a domain name resolution server developed by the Dutch company PowerDNS. There is a security vulnerability in PowerDNS Recursor, which can trigger internal inconsistencies due to the region conversion from NSEC to NSEC3, resulting in a denial-of-service attack...

PT-2026-34357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ext4 filesystem where the system fails to convert files from inline data storage to extent-based storage when a truncate operation increases the file size beyond t...

OAuth2 Proxy security vulnerability

OAuth2 Proxy is a product developed by OAuth2 Proxy organization that can provide a reverse proxy for authentication with Google, Github, or other providers. There were security vulnerabilities in the versions of OAuth2 Proxy from 7.5.0 to 7.15.1. These vulnerabilities stemmed from the possibilit...

WordPress Plugin “Call To Action Plugin” Vulnerability Due to Cross-Site Request Forgery

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-34370

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the writeback mechanism where the system blocks sync for filesystems that cannot guarantee data persistence, such as fuse. This occurs because the system waits for...

PowerDNS Recursor (pdns_recursor) code-related vulnerabilities

PowerDNS Recursor pdnsrecursor is a domain name resolution server developed by the Dutch company PowerDNS. There is a code vulnerability in PowerDNS Recursor. This vulnerability arises from the use of the zoneToCache function, where attackers can send zones that result in null pointer...

PT-2026-37166

Name of the Vulnerable Software and Affected Versions Nornicdb versions prior to 1.0.42-hotfix Description The Bolt listener always binds to the wildcard address all interfaces, regardless of the user configuration. This occurs because the --address CLI flag, the NORNICDB ADDRESS environment...