CVE-2026-75993: Improper Neutralization of Input During Web Page Generation

ColdFusion is affected by a reflected Cross-Site Scripting XSS vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user...

PT-2026-88661

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in Web Authentication allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded from...

PT-2026-88752

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the PushAPI allows a remote attacker who has compromised the renderer process to bypass the web origin policy using a crafted HTML page. The web origin policy...

PT-2026-88547

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Network component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded...

CVE-2026-61516: Insufficiently Protected Credentials

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the...

Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information

...

PT-2026-88746

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A use after free issue exists in the Web Authentication component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A...

NewStart CGSL MAIN 7.02 : python-PyJWT Multiple Vulnerabilities (NS-SA-2026-0091)

The remote NewStart CGSL host, running version MAIN 7.02, has python-PyJWT packages installed that are affected by multiple vulnerabilities: - PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 4.1.11...

CVE-2026-76002: Improper Neutralization of Input During Web Page Generation

ColdFusion is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed...

ROS-20260908-73-0096

The vulnerability in Grafana relates to the lack of security measures for the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Koha Eval Code Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper...

MAL-2026-16199 Malicious code in plogme (npm)

plogme is a renamed fork of the Baileys WhatsApp Web library from the same publisher-controlled family as @crysnovax/baileys MAL-2026-15917, and versions 1.0.0 through 1.0.3 carry the same forced-follow and fingerprint modules. lib/Utils/channel-policy.js javascript-obfuscator output, identical t...

CVE-2026-86300

A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used...

EUVD-2026-72351

A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2026-86300 Tenda AC9 Web Management R7WebsSecurityHandler improper authentication

A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2026-86300

An improper authentication flaw in the R7WebsSecurityHandler function of the Web Management component of Tenda AC9 firmware 15.03.05.14 allows a remote, unauthenticated attacker to bypass authentication with low complexity. The CVSS 3.1 base score is 7.3 (HIGH) with impacts of low confidentiality...

CVE-2026-86300 Tenda AC9 Web Management R7WebsSecurityHandler improper authentication

A flaw has been found in Tenda AC9 15.03.05.14. This impacts the function R7WebsSecurityHandler of the component Web Management. This manipulation causes improper authentication. The attack may be initiated remotely. The exploit has been published and may be used...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Spring Web integration, Qute, OIDC, RESTEasy and SmallRye GraphQL Vulnerability Details CVEID:CVE-2026-19651 DESCRIPTION: Quarkus quarkus-spring-web extension could allow an attacker to bypass authorization by manipulating...

Malicious code in wallet-cds-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90a2fd556bde6edbeed9d4c1ebd8dcf4b1c24a5dfda8d70d6cb91cfc7ee3fa2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16040 Malicious code in wallet-cds-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90a2fd556bde6edbeed9d4c1ebd8dcf4b1c24a5dfda8d70d6cb91cfc7ee3fa2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...