CVE-2026-23760

SmarterTools SmarterMail versions before build 9511 are affected by an authentication bypass in the password reset API. The force-reset-password endpoint allows anonymous requests and does not verify the current password or a reset token when resetting system administrator accounts, enabling an u...

CVE-2026-0723 Unchecked Return Value in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 that could have allowed an individual with existing knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device...

CVE-2026-24034

Horilla is a free and open source Human Resource Management System HRMS. In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1.5.0 fixes the issue...

CVE-2026-24034 Horilla has File Upload XSS

Horilla is a free and open source Human Resource Management System HRMS. In versions prior to 1.5.0, a cross-site scripting vulnerability can be triggered because the extension and content-type are not checked during the profile photo update step. Version 1.5.0 fixes the issue...

CVE-2026-23699

AP180 series with firmware versions prior to APRGOS 11.94B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices...

CVE-2026-23699

AP180 series with firmware versions prior to APRGOS 11.94B1P8 contains an OS command injection vulnerability. If this vulnerability is exploited, arbitrary commands may be executed on the devices...

EUVD-2026-3699

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL Magick Scripting Language parser when processing tags before images are loaded. This can lead to DoS attack due to...

CVE-2026-23952 ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL Magick Scripting Language parser when processing tags before images are loaded. This can lead to DoS attack due to...

CVE-2026-23952 ImageMagick has a NULL pointer dereference in MSL parser via <comment> tag before image load

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL Magick Scripting Language parser when processing tags before images are loaded. This can lead to DoS attack due to...

CVE-2026-23952

CVE-2026-23952 affects ImageMagick: a NULL pointer dereference in the MSL parser when processing tags before any image loads. Versions 14.10.1 and earlier are vulnerable; the issue can cause a DoS (assertion failure on debug builds or NULL dereference on release builds). A fix exists in version ...

WordPress plugin Ravpage has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

Neo4j Enterprise Edition security vulnerabilities

Neo4j Enterprise Edition is a graph database developed by the American company Neo4j. Versions prior to 2025.11.2 and 5.26.17 contained security vulnerabilities. These vulnerabilities allowed attackers to enumerate property values by observing error messages, potentially leading to information...

Typebot security vulnerabilities

Typebot is an open-source chat bot builder developed by Baptiste Arnaud. Versions of Typebot prior to 3.13.2 contained a security vulnerability. This vulnerability stemmed from client-side script execution, where credential endpoints returned plaintext API keys, which could lead to the theft of...

WordPress plugin Hostiko has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

WordPress plugin DotLife has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

CBL Mariner 2.0 Security Update: CBL-Mariner Releases (CVE-2025-64505)

The version of CBL-Mariner Releases installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-64505 advisory. - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG...

Azure Linux 3.0 Security Update: python-waitress (CVE-2022-31015)

The version of python-waitress installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-31015 advisory. - Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and...

Azure Linux 3.0 Security Update: gssntlmssp (CVE-2023-25564)

The version of gssntlmssp installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-25564 advisory. - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to...

Dell PowerScale OneFS security vulnerabilities

Dell PowerScale OneFS is an operating system developed by the American company Dell. It provides a horizontally scalable NAS solution through the PowerScale OneFS operating system. Versions of Dell PowerScale OneFS prior to 9.13.0.0 contained a security vulnerability. This vulnerability stemmed...

Aida Hotel Guest Hotspot security vulnerability

Aida Hotel Guest Hotspot is a hotel WiFi system developed by the Turkish company Aida. Versions of Aida Hotel Guest Hotspot prior to 22012026 contained a security vulnerability caused by improper handling of special elements, which could lead to SQL injection attacks...