Google Chrome Microsoft Edge Navigation XSS

The vulnerability in the Navigation function of Google Chrome and Microsoft Edge is related to authorization errors. Exploitation of this vulnerability may allow a remote attacker to gain access to protected information and trigger a denial-of-service condition via a specially crafted HTML page...

VulnCheck KEV: CVE-2020-35847

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function...

Beatriceodera cak-filemanagement-system arbitrary file upload vulnerability

The Beatriceodera cak-filemanagement-system versions 5e6433246475e66462e1fea980688de96a049297 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the File parameter in the moveuploadedfile function within the admin/addlogs.php file, potentially allowin...

themefusion Avada arbitrary file upload vulnerability

Theme Fusion Avada versions 7.16.2 and earlier contain an arbitrary file upload vulnerability. This vulnerability stems from insufficient validation of file types prior to processing uploaded files by the convertpaletteimagestotruecolor function, potentially allowing unauthenticated attackers to...

Red Hat Enterprise Linux race condition vulnerability

A race condition vulnerability exists in Red Hat Enterprise Linux kernel versions 9.6 through 9.10. This vulnerability stems from an imbalance in localbh within the seg6inputcore function; when returning from a discard path, the lower half remains disabled, potentially leading to softirq starvati...

Phillip Hellewell AFFLIB buffer error vulnerability

Phillip Hellewell: Versions 3.7.22 and earlier of AFFLIB contain a buffer error vulnerability. This vulnerability stems from an out-of-bounds write in the afgetpage function. By providing a specially crafted AFF image where the page size does not match the sector size, attackers can trigger a...

WordPress Formidable Forms input validation error vulnerability

WordPress Formidable Forms versions 6.35 and earlier contain an input validation error vulnerability. This vulnerability stems from insufficient validation of URL prefixes in the validateurlisins3bucket function. Additionally, the permission callback relies solely on a shared token without checki...

Dustin Lundquist SNI Proxy improper exception handling vulnerability

Dustin Lundquist: The SNI Proxy versions 0.7.0 and earlier contain an improper exception handling vulnerability. This flaw stems from a null pointer dereference in the resolvcancel function. Remote unauthenticated attackers can exploit this by sending a TLS SNI name or HTTP Host header containing...

FOSSBilling cross-site request forgery vulnerability

Versions of FOSSBilling prior to 0.8.9 contain a cross-site request forgery vulnerability. This flaw arises because the checkGuestClientAuthentication function on the employee guest login endpoint POST /api/guest/staff/login permits only clientlogin and clientcreate. As a result, stafflogin lacks...

Towfiq I. SerpBear authorization issue vulnerability

Versions prior to Towfiq I. SerpBear 3.1.1 contain an authorization issue vulnerability. This vulnerability stems from a lack of authentication in pages/api/notify.ts; the verifyUser function is never invoked. Remote unauthorized attackers can repeatedly send POST requests to /api/notify—optional...

GNU C Library path traversal vulnerability

GNU C Library versions 2.0 and later contain a path traversal vulnerability. This vulnerability arises because the gettext function family accepts LANGUAGE environment variable entries containing “/” or equal to “..”. As a result, message directories can be loaded from any location within the fil...

AdminNeo SQLite: multi_query Incorrect Check of Function Return Value RCE

This vulnerability is a patch bypass that exploits catastrophic backtracking in a regular expression used to filter ATTACH statements in AdminNeo's SQLite functionality. The original vulnerability CVE-2021-43008 allowed authenticated users to create PHP files through SQLite ATTACH statements,...

PT-2026-134232

Name of the Vulnerable Software and Affected Versions LubeLogger versions prior to 1.6.8 Description An authenticated user can cause cross-user disclosure of vehicle maintenance records. The PrintRecordStickers function in /Controllers/VehicleController.cs verifies if the caller can view the...

CVE-2026-76012: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code…

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacyrender function. This is due to broken authorization on the Lightroom galleryedit endpoint combined with mass...

Important: gstreamer1-plugins-good

Issue Overview: GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack...

CVE-2026-97645: Gravity Forms: The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up…

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

PT-2026-133301

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

CVE-2026-54610: libredwg: LibreDWG is a free C library to read and write DWG files

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, bitTVtoutf8 in src/bits.c can write to the caller-provided src buffer despite accepting const input. On an iconv error other than E2BIG, the function frees its output buffer and passes the original input alias to bituexpand,...

CVE-2026-118938: trailofbits fickling: In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example…

In Trail of Bits fickling through 0.1.12, a pickle STACKGLOBAL operand carrying a dotted qualname for example "Values.readfile" is resolved by pickle's findclass through getattribute to an arbitrary attribute path rather than to a module-level function. Fickling records only the leading component...

PT-2026-133305

A flaw was found in gcc. An attacker could cause a Denial of Service DoS by passing a string that is not null-terminated to the std::from chars function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or ...