CVE-2026-54165: Improper Neutralization of Input During Web Page Generation

Dobase is an open-source, self-hosted workspace with installable tools. Versions prior to 2026.06.03 have a one-click stored DOM-based cross-site scripting XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and is never...

CVE-2026-79393

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary cod...

PT-2026-96613

An issue in wpa supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c...

PT-2026-90515

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header. A...

PT-2026-89904

MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a catego...

PT-2026-90055

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a condition where malicious scripts are injected into trusted websites. Th...

CVE-2026-77490: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-79393: Heap-based Buffer Overflow

A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary cod...

KLA91276 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of...

RHEL 8 : glib2 (RHSA-2026:66451)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:66451 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, th...

CVE-2026-48490: Buffer Copy without Checking Size of Input

ArduinoCore-avr contains the source code and configuration files of the Arduino AVR Boards platform. A vulnerability in versions prior to 1.8.8 allows an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino Stri...

CVE-2026-89584: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: block: validate user space vectors during extraction The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate use...

Linux Distros Unpatched Vulnerability : CVE-2026-57222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 an...

CVE-2022-26962

Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NPBCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or mrfAnnouncementNameparameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The maliciou...

Security Bulletin: IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands under certain conditions (CVE-2026-86093)

Summary IBM® Db2® federated server could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds...

Security Bulletin: IBM MQ Appliance is affected by an improper validation vulnerability in cluster migration data processing (CVE-2026-11716)

Summary IBM MQ Appliance has addressed an improper validation vulnerability in cluster migration data processing that could allow an authenticated attacker to cause a denial of service or execute arbitrary code during queue manager startup. Vulnerability Details CVEID:CVE-2026-11716 DESCRIPTION:...

SUSE CVE-2026-86138

In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow...

SUSE CVE-2026-86140

In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow...

SUSE CVE-2026-86142

In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation...

CVE-2026-88959

Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or...