WordPress Contact Form by Supsystic plugin <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header vulnerability

Unauthenticated Stored Cross-Site Scripting via IP Address Header vulnerability discovered by andrea bocchetti in WordPress Plugin Contact Form by Supsystic versions = 1.10.2...

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

A TantoSec proof-of-concept turns an AES-CBC "padding oracle" in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in July. There are no confirmed reports of exploitation i...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin < 3.6.5.2 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Sai Praneeth Koti in WordPress Plugin JetFormBuilder versions 3.6.5.2...

CVE-2026-84732

A flaw was found in OpenVPN. Remote unauthenticated attackers can cause a denial of service by sending specially crafted network inputs. These inputs trigger a timeout integer overflow during the retransmission of acknowledgment ACK packet IDs, which can make the OpenVPN service unavailable...

DoS (Denial of Service) io.netty:netty-codec Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, and 10.3.0 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

DoS (Denial of Service) io.netty:netty-handler Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, and 10.3.0 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

Improper Authorization io.netty:netty-handler Dependency in Bitbucket Data Center

This High severity Improper Authorization vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, and 10.3.0 of Bitbucket Data Center. This Improper Authorization vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

BASM (Broken Authentication & Session Management) Netty Dependency in Bitbucket Data Center and Server

This High severity BASM Broken Authentication & Session Management vulnerability known as CVE-2026-50010 was introduced in 9.0.1 and later of Bitbucket Data Center and Server. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

WordPress SureForms plugin <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload vulnerability

Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload vulnerability discovered by daroo in WordPress Plugin SureForms versions = 2.12.2...

WordPress QuickCal plugin <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters vulnerability

Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters vulnerability discovered by adhikara13 in WordPress Plugin QuickCal - Appointment Booking Calendar for WordPress versions = 1.0.20...

Deserialization Of Untrusted Data

Spring Integration is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to SerializingHttpMessageConverter deserializing HTTP request bodies using ObjectInputStream.readObject without class filtering, which allows an unauthenticated attacker to provide a crafted serialized...

SUSE-SU-2026:23523-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issue: - CVE-2026-82397: an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection bsc1277725...

CVE-2026-84732

Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow...

WordPress iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite vulnerability discovered by Pham Duc Anh in WordPress Plugin iubenda versions = 3.13.4...

WordPress iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability discovered by daroo in WordPress Plugin iubenda versions = 3.13.4...

CVE-2026-84186 Incorrect access control in PrestaShop

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

Security Bulletin: IBM Documentation Offline is vulnerable to `Denial of Service via __proto__ header name in req.headersDistinct` due to Node.js (CVE-2026-21710)

Summary IBM Documentation Offline utilizes Node.js as a third-party component, which contains a vulnerability that could potentially affect your product's stability and security. CVE-2026-21710 CVSS: 3.1 is a denial-of-service DoS vulnerability identified in the Node.js core HTTP module. An...

WordPress Music Store plugin < 1.4.5 - Unauthenticated SQLi vulnerability

Unauthenticated SQLi vulnerability discovered by nobody in WordPress Plugin Music Store versions 1.4.5...

N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw

Every on-premises N-central build below 2026.3.1.14 — including servers updated to Hotfix 3 a day earlier — needs Hotfix 4. N-able's incident notice says the flaw has been exploited in the wild; its release notes say that is unconfirmed. N-able has released its fourth hotfix in five weeks for the...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure vulnerability

Unauthenticated Password Hash and Arbitrary Metadata Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin JetFormBuilder versions 3.6.5.2...