EUVD-2026-89966

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...

CVE-2026-103227

A buffer overflow vulnerability exists in GPAC up to version 26.07.0 . The issue originates in the DASH Client component, specifically within the gf_dash_resolve_url function located in src/media_tools/dash_client.c. This flaw allows for remote exploitation by an attacker. To remediate this vulne...

CVE-2026-103227 GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow

A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gfdashresolveurl of the file src/mediatools/dashclient.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be carried out remotely. Upgrading to version...

CVE-2026-86248

A flaw was found in Apache Tomcat. When client certificate authentication is configured with strict certificate revocation checking, Online Certificate Status Protocol OCSP verification may improperly allow connections instead of failing as intended. A remote attacker presenting an invalid or...

CVE-2026-97274

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...

CVE-2026-97078

Unauthenticated Insecure Direct Object References IDOR in Client Invoicing by Sprout Invoices = 20.8.17 versions...

CVE-2026-97274

The WordPress OAuth Single Sign On – SSO (OAuth Client) plugin, versions

EUVD-2026-89923

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...

CVE-2026-97274 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO OAuth Client = 7.1.2 versions...

CVE-2026-97078

The Client Invoicing by Sprout Invoices WordPress plugin versions

CVE-2026-97078 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Client Invoicing by Sprout Invoices = 20.8.17 versions...

CVE-2026-97078 WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Client Invoicing by Sprout Invoices = 20.8.17 versions...

CVE-2026-10739

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe...

CVE-2026-10726

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

RLSA-2026:73130 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Privilege escalation in the DOM: Workers component CVE-2026-16365 firefox: thunderbird: Sandbox escape in the Remote Settings Client component CVE-2026-75874 firefox: Sandbox escape due to...

EUVD-2026-89780

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

CVE-2026-10726

The Cato Windows SDP Client before version 6.12.6 is vulnerable to an arbitrary file disclosure vulnerability. A low-privileged local user can exploit this flaw to force the Windows service—which operates with Local System privileges—to read and disclose arbitrary local files. The root cause is a...

CVE-2026-10726 Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

CVE-2026-10726 Cato Windows SDP Client arbitrary file disclosure due to improper TLS certificate validation

Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to improper file path validation and missing TLS certificate...

CVE-2026-10739 Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation

Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe...