EUVD-2026-56000

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery SSRF vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center...

WordPress WP Directory Kit plugin <= 1.5.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Taylsec in WordPress Plugin WP Directory Kit versions = 1.5.4...

CVE-2026-68265

A flaw was found in the Linux kernel. Specifically, within the drm/xe/vm module, an out-of-bounds access can occur when handling the DRMXECONSULTMEMADVISEPREFLOC region for a Buffer Object BO Virtual Memory Area VMA. This happens because a value of -1 is incorrectly used as an index into a memory...

WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dahmani Toumi pegaSUS in WordPress Plugin Solace Extra versions = 1.6.0...

MAL-2026-13763 Malicious code in fetch-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5c49646ea7e22e74073aa7d8c9596d7d93100c429033383e975a2ab080de28 Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' repository, README, and author metadata all reference...

Malicious code in lines-columns (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c9abe51d09dfaa6a2e38e60df64038009c1029b34587cc2c8906d37642187cd Package name 'lines-columns' closely resembles the popular 'lines-and-columns' package, and the README instructs users to install 'lines-and-columns'...

CVE-2026-58231

Technical details about CVE-2026-58231 are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-55999

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...

CVE-2026-58231 Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...

CVE-2026-73160

Affected versions of cti-transmute contain an SSRF vulnerability in the /fetchmispevent and /mispsearchevents endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain...

CVE-2026-10579

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted...

CVE-2026-15560

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

EUVD-2026-55992

Affected versions of cti-transmute contain an SSRF vulnerability in the /fetchmispevent and /mispsearchevents endpoints. The URL validation routine checked whether a supplied hostname was itself an IP literal and rejected private, loopback, link-local, or reserved IPs. However, ordinary domain...

TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool

More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-021...

CVE-2026-68199

A flaw was found in the Linux kernel's ath6kl Wi-Fi driver. This vulnerability allows a local attacker to cause an out-of-bounds memory access. The flaw occurs when the firmware provides an invalid window size during an ADDBA Add Block Ack request, leading to incorrect memory allocation. This can...

CVE-2026-71218

CVE-2026-71218 in iperf3 involves a flaw in the JSON_read() function where a peer-controlled message length is accepted and memory is allocated without an upper bound. This can cause excessive memory consumption, leading to DoS via memory exhaustion, severe slowdown, or service termination. The i...

CVE-2026-68355

A flaw was found in the ath11k component of the Linux kernel. When processing Wi-Fi wireless fidelity data, a specific function can attempt to access memory outside of its allocated buffer. This buffer underflow occurs if the first entry in a data structure has a zero buffer address, leading to a...

CVE-2026-73151

A flaw was found in svxlink's remotetrx NetUplink component. An unvalidated audio length field enables an out-of-bounds read, and when AUTHKEY is not set, transceiver control functions are exposed to unauthenticated remote access. This allows unauthorized control of radio hardware connected to th...

CVE-2026-15567

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

CVE-2026-34191

A flaw was found in Apache Portable Runtime Utility. This vulnerability, known as SQL Injection, occurs in the aprdbdoracle provider. A remote attacker could exploit this by injecting malicious SQL commands, potentially leading to unauthorized access, modification, or deletion of data within the...