CVE-2026-26720

Twenty CRM versions prior to 1.15.0 are affected by CVE-2026-26720, with the root cause in the local.driver.ts module allowing a remote attacker to execute arbitrary code. Affected product: Twenty CRM (v1.15.0 and earlier). Impact is high/critical per CVSS, including potential full compromise. Re...

CVE-2026-26720

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module...

PT-2026-22614

Name of the Vulnerable Software and Affected Versions Twenty CRM versions prior to 1.15.0 Description An issue exists in Twenty CRM that allows a remote attacker to execute arbitrary code via the local.driver.ts module. Recommendations Update to a version later than 1.15.0...

Memory Free After Use Vulnerability in Adobe After Effects 25.6 and Prior Versions

Adobe After Effects is a set of visual effects and motion graphics production software from the American company Audobee Adobe. The software is mainly used for 2D and 3D synthesis, animation and visual effects production. Adobe After Effects 25.6 and earlier versions suffer from a Memory Free Aft...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-005557)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005557 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udfgetfileshortad Check for overflow when computing alen in...

CVE-2026-26720

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module...

CVE-2026-26720

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module...

CVE-2026-21660

Hardcoded Email Credentials Saved as Plaintext in Firmware CWE-256: Plaintext Storage of a Password vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick...

CVE-2026-21659

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion LFI vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects...

CVE-2026-21654

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security o...

CVE-2026-21656

Improper Control of Generation of Code 'Code Injection' vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication...

CVE-2026-28411

creationtimestamp| type| source ---|---|--- 2026-02-28 00:00:43+00:00| seen| https://infosec.exchange/users/offseq/statuses/116145313710936969 2026-02-28 00:00:45+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mfuw7sp34d2h 2026-02-28 01:06:12+00:00| seen|...

CVE-2026-27540

creationtimestamp| type| source ---|---|--- 2026-02-27 21:03:02+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mfumc26ug72k 2026-03-19 06:36:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhff6wxohx2k 2026-03-19 06:53:37+00:00| seen|...

CVE-2026-28338 PMD Designer has Stored XSS in VBHTMLRenderer and YAHTMLRenderer via unescaped violation messages

PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's vbhtml and yahtml report formats insert rule violation messages into HTML output without escaping. When PMD analyzes untrusted source code containing crafted string literals, the generated HTML report contains...

ShinyHunters Leak 2M Records From Dutch Telecom Odido, Claim 21M Stolen

ShinyHunters hackers leak 2 million records from Dutch telecom Odido after ransom refusal, claiming up to 21 million customer records were stolen in the breach...

CVE-2026-27836

creationtimestamp| type| source ---|---|--- 2026-02-27 12:36:41+00:00| published-proof-of-concept| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w22q-m2fm-x9f4 2026-02-28 01:40:11+00:00| seen| https://gist.github.com/alon710/ddf713b6949e1e0ad41c8c6c2f71cccf 2026-02-28...

EUVD-2026-9019

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion LFI vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects...

CVE-2026-24352

PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this...

CVE-2026-21659

Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion LFI vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects...

CVE-2026-21660

A Hardcoded Email Credentials Saved as Plaintext in Firmware CWE-256: Plaintext Storage of a Password vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Fri...