EUVD-2026-54142

Insufficient validation of untrusted input in UI in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

EUVD-2026-54209

The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...

EUVD-2026-54208

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior...

EUVD-2026-54124

Insufficient validation of untrusted input in Workers in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: High...

EUVD-2026-54269

Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: High...

EUVD-2026-54202

The Event Booking Manager for WooCommerce Pro WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native non-WooCommerce checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows...

EUVD-2026-54187

The Easy Appointments WordPress plugin through 3.12.26 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to...

EUVD-2026-54197

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore...

EUVD-2026-54302

The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked as paid, nor does it verify the authenticity of its payment-completion request, allowing unauthenticated attackers to reuse a single valid...

EUVD-2024-55712

The Class Mediator fails to correctly validate or sanitize messageContext properties when they are used to populate dynamic values. This allows authenticated users to potentially access or modify data across different system invocations that should be isolated. This weakness can lead to the...

The vulnerability of the Extensible Messaging Client Protocol (XMCP) in Cisco IOS and Cisco IOS XE operating systems allows a perpetrator to induce a service failure.

The vulnerability of the Extensible Messaging Client Protocol XMCP in Cisco IOS and Cisco IOS XE operating systems lies in the lack of input validation for cyclic operations. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of Cisco IOS XE operating systems, related to insufficient validation of input data, allows attackers to compromise the accessibility of protected information.

The vulnerability of Cisco IOS XE operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to compromise the accessibility of protected information...

The vulnerability in the web interface of the Cisco Integrated Management Controller (IMC) allows a perpetrator to execute arbitrary commands and increase their privileges.

The vulnerability of the Cisco Integrated Management Controller IMC’s web management interface is related to improper validation of request parameters. Exploiting this vulnerability allows an attacker to execute arbitrary commands and elevate their privileges to the root level...

PT-2026-69151

Name of the Vulnerable Software and Affected Versions JupyterHub versions prior to 5.5.0 Description Invalid input provided to form-based login authenticators allows an unauthenticated attacker to insert an unbounded, attacker-controlled username into failed-login logs. This can lead to the...

Fedora 43 : curl (2026-097fb2e7e9)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-097fb2e7e9 advisory. - fix cross-proxy Digest auth state leak CVE-2026-7168 - fix cross-origin Digest auth state leak CVE-2026-11856 - fix password leak with netrc and...

Cisco Catalyst SD-WAN Software Security Hardening (cisco-sa-hardening-sdwan-faLcR3K)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by multiple vulnerabilities. - Multiple vulnerabilities in Cisco Catalyst SD-WAN Software could allow an authenticated, remote attacker to conduct path traversal attacks, gain unauthorized access, or cause a denial ...

PT-2026-76583

Name of the Vulnerable Software and Affected Versions Libevent versions prior to 2.1.13 Libevent versions prior to 2.2.2-alpha Description Two HTTP parsing weaknesses exist in the http.c file. The function evhttp decode uri internal decodes percent-encoded %00 bytes into literal NUL characters,...

The vulnerability in the web interface of the Cisco Integrated Management Controller (IMC) allows a perpetrator to execute arbitrary commands and increase their privileges.

The vulnerability of the Web interface for managing Cisco Integrated Management Controllers involves insufficient validation of data entered by users. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands and elevate their privileges to the root level...

The vulnerability of the programmatically defined Cisco Catalyst SD-WAN (formerly Cisco SD-WAN) lies in insufficient validation of input data, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the programmatically defined Cisco Catalyst SD-WAN formerly Cisco SD-WAN is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information...

CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...