CVE-2026-49113

Subscriber Arbitrary Code Execution in Cornerstone 7.8.8 versions...

CVE-2026-39596

Unauthenticated SQL Injection in Blocksy Companion Pro 2.1.29 versions...

CVE-2026-39582

Unauthenticated Local File Inclusion in Hitek 1.8.3 versions...

CVE-2026-39547

Unauthenticated Local File Inclusion in Getaway 1.8 versions...

CVE-2026-39529

Unauthenticated PHP Object Injection in Elementra = 1.0.9 versions...

CVE-2026-34894

Unauthenticated Local File Inclusion in Integrio Core 1.2.8 versions...

CVE-2026-34895

Unauthenticated Local File Inclusion in Softlab Core 1.2.11 versions...

CVE-2026-32967

Incorrect Authorization vulnerability of /v2 experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue...

CVE-2026-27395

Unauthenticated Privilege Escalation in Support Board 3.8.9 versions...

CVE-2026-12462

Use after free in Media in Google Chrome prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-12456

Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. Chromium security severity: High...

DEBIAN-CVE-2026-12446

Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2025-69161

Unauthenticated Local File Inclusion in Snowy = 1.13 versions...

CVE-2026-12438

Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-40720

Concretely, CVE-2026-40720 affects the WordPress plugin Royal Elementor Addons Pro (versions below 1.7.1041). The issue is an Unauthenticated Cross Site Scripting (XSS) vulnerability discovered in these versions. CVSSv3.1 base score is 7.1 (HIGH) with network exploitation potential, no privileges...

CVE-2026-39559 WordPress Uppercase theme < 1.2.2 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...

CVE-2025-69140 WordPress SweetDate Core plugin < 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SweetDate Core 1.1.5 versions...

CVE-2025-69140

The CVE is for WordPress SweetDate Core plugin versions before 1.1.5, which are affected by an unauthenticated reflected XSS vulnerability. Root cause details aren’t provided in the documents, but the issue is tied to SweetDate Core

dovecot: denial of service via crafted message before authentication

A flaw was found in dovecot. An unauthenticated and remote attacker can send a crafted message that causes managesieve to allocate an excessive amount of memory, forcing managesieve-login to be unavailable by repeatedly crashing the process, resulting in a denial of service...

CVE-2026-54811

CVE-2026-54811 : Affected software is the WordPress WP eMember plugin versions older than 10.9.4. The issue is an unauthenticated SQL Injection in the plugin, allowing an attacker with network access (no user credentials, no UI interaction) to potentially read or exfiltrate data. The CVSS metrics...