CVE-2026-82100: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...

CVE-2026-79742: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist...

CVE-2026-71808

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

WordPress Aruba HiSpeed Cache plugin <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Aruba HiSpeed Cache versions = 3.0.14...

EUVD-2026-75028

Rara One Click Demo Import plugin for WordPress before 1.3.5 contains an arbitrary file upload vulnerability that allows authenticated attackers with Administrator privileges to upload arbitrary PHP files by passing a false value to wphandleupload that disables WordPress core's file type validati...

WordPress CalJ Shabbat Times plugin <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification vulnerability

Authenticated Subscriber+ Arbitrary Settings Modification vulnerability discovered by Nabil Irawan - Heroes Cyber Security in WordPress Plugin CalJ Shabbat Times versions = 1.5...

PT-2026-89153

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

EUVD-2026-75159

A SQL Injection vulnerability in Siam Ordering siam-server 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the $ string concatenation in AdminMapper.java and multiple other Mapper files including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.ja...

PT-2026-88991

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS SEND PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust serve...

CVE-2026-70283

Incorrect authorization in Windows Win32K allows an authorized attacker to elevate privileges locally...

CVE-2026-69777

Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2026-68786

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-67642

Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-54611

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-54611 InstantCMS has Remote Code Execution in package installer

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-54611 InstantCMS has Remote Code Execution in package installer

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-69478

CVE-2026-69478 is a heap-based buffer overflow in the Windows Device Association Service that allows an authorized attacker to elevate privileges locally . The vulnerability is rated CVSS 7.8 (HIGH) with a local attack vector, low complexity, and low privileges required, resulting in high impact ...

EUVD-2026-73418

Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network...

EUVD-2026-73351

Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally...

CVE-2026-69681

CVE-2026-69681 is a heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver that allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 8.0 (HIGH) with a vector of AV:N/AC:L/PR:L/UI:R, indicating a network attack with low complexity, low privi...