CVE-2026-76235

A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service. Mitigation Restrict network access...

CVE-2026-73388

Nikstore Core is a WordPress plugin affected by an unauthenticated SQL injection vulnerability in versions ≤ 1.5 . The flaw allows a remote, unauthenticated attacker to inject SQL queries over the network with low complexity, resulting in high confidentiality impact and low availability impact (C...

CVE-2026-73384

Pay with Contact Form 7 is a WordPress plugin affected by an unauthenticated sensitive data exposure vulnerability in versions

CVE-2026-73363 WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...

EUVD-2026-62381

Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...

CVE-2026-73347 WordPress TrueBooker plugin <= 1.2.6 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...

mysql: Replication unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily...

mysql: Group Replication Plugin unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and...

PYSEC-2026-3687 MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...

PYSEC-2026-3664 Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Summary Glances provides asdictsecure explicitly designed for unauthenticated API access, with a docstring stating it returns "a sanitised copy of the configuration dict" where "Sensitive keys in remaining sections are replaced by ''". However, the implementation only checks KEY names against a...

CVE-2026-66257

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service DoS. A denial ...

Vulnerabilities in Oracle PeopleSoft Enterprise

Oracle has identified several vulnerabilities in Oracle PeopleSoft Enterprise PeopleTools, including the Integration Broker, Data Mover, Configuration Manager, FIN Common Objects, FIN Lease Administration, and CC Common Application Objects, specifically in versions 8.61 through 8.63 and 9.1 throu...

vulnerabilities present in Oracle Java SE

Oracle has identified vulnerabilities in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. These vulnerabilities affect several supported versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition. An unauthorized attacker with network...

Reverse-Lookup Service Exposed Millions of Photos of People’s Faces

The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed...

Vulnerabilities are managed in Oracle Enterprise Manager

Oracle has identified several vulnerabilities in various components of Oracle Enterprise Manager. The vulnerabilities in Oracle Enterprise Manager Base Platform and Oracle Enterprise Manager for Systems Infrastructure involve multiple issues where an attacker with low privileges—or even without...

vulnerabilities present in Oracle E-Business Suite

Oracle has identified vulnerabilities in various components of the Oracle E-Business Suite, including General Ledger, Payments, Workflow, Sales, Purchasing, Call Center Technology, and other modules within versions 12.2.3 through 12.2.15. These vulnerabilities enable attackers with low to high...

WordPress SAML Single Sign On plugin 4.8.85-5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite vulnerability

Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite vulnerability discovered by Suhayb Ahmed in WordPress Plugin SAML Single Sign On – SSO Login versions 4.8.85-5.4.6...

Exploit for CVE-2026-53959

CVE-2026-53959 - 4gaBoards python exploit.py http://localhost...

CVE-2026-15780

The WP Statistics WordPress plugin (≤14.16.8) is vulnerable to unauthenticated stored XSS via the utm_campaign parameter, exploitable through the public /wp-statistics/v2/hit REST endpoint where a base64-encoded page_uri overrides sanitized REQUEST_URI. A fix commit exists on GitHub. No active ex...

CVE-2026-19709

The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...