CVE-2026-114486

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...

CVE-2026-114486

The Devolutions Server (versions 2026.3.10.0 and earlier) is vulnerable to an incorrect authorization issue in the Devolutions Gateway token generation. An authenticated non-administrative attacker can bypass the Network Access Rules of a virtual gateway to reach denied hosts by utilizing wildcar...

Security Bulletin: Platform Navigator and Automation Assets in IBM Integration are vulnerable to a vulnerability in proxy-addr

Summary Platform Navigator and Automation Assets in IBM Integration are vulnerable to a vulnerability in proxy-addr. CVE-2026-90711 The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client addre...

CVE-2026-113582

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay

A flaw was found in OpenSSH's SSH daemon sshd. A remote attacker could exploit this vulnerability by repeatedly attempting authentication. The flaw allows the attacker to bypass the intended minimum authentication delay, which can facilitate brute-force attacks. This makes it easier for an attack...

CVE-2026-113582

This vulnerability affects all versions of Apache Abdera due to improper restriction of XML external entity references during Atom document parsing. An attacker could potentially access sensitive data or trigger server-side requests by providing attacker-controlled XML. Because Apache Abdera is r...

EUVD-2026-108166

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

CVE-2026-113582 Apache Abdera: XML external entity expansion in Atom document parsing

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

CVE-2026-113582

UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects Apache Abdera: all versions. Apache Abdera ...

WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ssophiz in WordPress Plugin UPI QR Code Payment Gateway for WooCommerce versions = 1.6.3...

WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dcs in WordPress Plugin WpEvently versions = 5.7.8...

SQL Injection

Overview mem0ai is a Long-term memory for AI Agents Affected versions of this package are vulnerable to SQL Injection via the Databricks vector store in mem0/vectorstores/databricks.py, where user-controlled payload values and vector IDs are interpolated directly into SQL statements without...

Vulnerabilities found in Cisco Expressway Series devices

Cisco has identified several vulnerabilities in the Cisco Expressway Series. These vulnerabilities involve insufficient authorization checks during Mobile and Remote Access provisioning, allowing unauthorized external attackers to gain access to sensitive information. Additionally, there is a...

USN-8952-1: Tornado vulnerabilities

It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,...

USN-8952-1 python-tornado vulnerabilities

It was discovered that Tornado did not properly handle certain HTTP requests and network inputs. An attacker could possibly use these issues to cause a denial of service, expose sensitive information, or bypass access controls. CVE-2023-54397, CVE-2024-14029, CVE-2026-91990, CVE-2026-91992,...

Several vulnerabilities exist in Oracle Java.

Oracle has identified several vulnerabilities in Oracle Java. In Oracle Java SE, JavaFX, and GraalVM Enterprise Edition, there are various vulnerabilities that can be exploited by unauthorized network attackers through exposed APIs or sandboxed Java applications. These vulnerabilities enable the...

CVE-2026-115334

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switchorganization/...

CVE-2026-115330

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only...

CVE-2026-112842

Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2...

CVE-2026-112842 WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through 3.1.2...