CVE-2026-66394

SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML...

EUVD-2026-49327

SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML...

EUVD-2026-49071

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store...

BIT-DOTNET-2026-50651 .NET Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-51297

...

PT-2026-65035

NGINX Plus and NGINX Open Source have a vulnerability in the ngx http charset module module. When content is served or proxied through a location block with both source charset utf-8; and a charset directive for example, charset koi8-r; configured, remote, unauthenticated attackers can send...

PT-2026-65010

Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-60324

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server: 9.7.0-9.7.1; MySQL Cluster: 9.7.0-9.7.1. Easily exploitable vulnerability allows low privilege...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

CVE-2026-66013

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

CVE-2026-66013

OpenRemote has a vulnerability (CVE-2026-66013) affecting versions before 1.26.2 where the console registration API is vulnerable to authentication bypass. This allows unauthenticated attackers to update existing console assets by supplying a known asset identifier, enabling them to overwrite pus...

PT-2026-64980

Name of the Vulnerable Software and Affected Versions SQLite version 3.41 Description A use-after-free flaw exists in the jsonRemoveFunc function of the SQLite JSON module. The issue occurs because a parsed JSON object is freed, but the system subsequently attempts to call jsonLookupStep using th...

EUVD-2026-48714

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

CVE-2026-66005 Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

CVE-2026-66005

CVE-2026-66005 affects Jan up to version 0.8.4. The local API server has a CORS misconfiguration that replaces user-configured trusted hosts with a wildcard, reflecting arbitrary origins with credentials. This enables network-adjacent attackers to bypass trusted host restrictions and reach the un...

CVE-2026-66005

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

Tego AI Discloses Second Claude Flaw in a Week: Hidden Link Silently Sends Files to Attackers

Tel Aviv, Israel, 24th July 2026, CyberNewswire...

CVE-2026-15821

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-12654

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers ...