EUVD-2026-37458

Vulnerability in the Oracle Application Development Framework ADF product of Oracle Fusion Middleware component: ADF Shared Components. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP...

Security Bulletin: IBM Security QRadar Log Management AQL Plugin is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. IBM Security QRadar Log Management AQL Plugin has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION: uuid is f...

CVE-2026-0019

In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0019

A logic error in SettingsLib allows an attacker to disable system components, potentially leading to a local escalation of privilege (EoP) without requiring additional execution privileges or user interaction. This vulnerability affects Android devices and is addressed in the Android 17 security ...

CVE-2026-0019

In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0019

In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0019: Improper Privilege Management

In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-46769: Undefined Security Weakness

Vulnerability in the Oracle Application Development Framework ADF product of Oracle Fusion Middleware component: ADF Shared Components. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP...

PT-2026-50225

Name of the Vulnerable Software and Affected Versions SettingsLib affected versions not specified Description A logic error in the code of SettingsLib allows for the disabling of system components. This issue can lead to local escalation of privilege without requiring additional execution...

NPM: Cross-site scripting via <NoScript> slot content in Nuxt's head components

NPM: Cross-site scripting via slot content in Nuxt's head components vulnerability discovered by ? in WordPress Npm nuxt versions 3.21.7...

Cross-site scripting via <NoScript> slot content in Nuxt's head components

Impact Nuxt's globally registered component from @unhead/vue head components, re-exported by Nuxt wrote its default-slot content to the innerHTML of the head tag, bypassing the HTML escaping that interpolation normally applies in Vue templates. Applications that placed untrusted,...

GHSA-M3Q2-P4FW-W38M Cross-site scripting via <NoScript> slot content in Nuxt's head components

Impact Nuxt's globally registered component from @unhead/vue head components, re-exported by Nuxt wrote its default-slot content to the innerHTML of the head tag, bypassing the HTML escaping that interpolation normally applies in Vue templates. Applications that placed untrusted,...

rsync: TOCTOU symlink race condition allowing local privilege escalation in daemon mode without chroot.

A flaw was found in rsync. An rsync daemon configured with "use chroot = no" is exposed to a time-of-check / time-of-use race on parent path components. A local attacker with write access to a module can replace a parent directory component with a symlink between the receiver's check and its open...

CVE-2026-12323 Spoofing issue in the DOM: Core & HTML component

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 — React2Shell Critical pre-authentication Remo...

Moderate: libxslt security update

libxslt is a library for transforming XML files into other textual formats including HTML, plain text, and other XML representations of the underlying data using the standard XSLT stylesheet transformation mechanism. Security Fixes: libxslt: use-after-free with key data stored cross-RVT...

CVE-2026-50884

Incorrect access control in statping-ng v0.93.0 allows attackers to escalate privileges to Administrator and access sensitive components...

3d-card (0.0.2), 4byte-peru-components (1.0.0) +314 more potentially affected by CVE-2026-54266 via @angular/common (>=19.0.0, <=19.2.25)

@angular/common NPM version =19.0.0, =3.19.0, =0.0.327, =19.0.0, =8.0.0, =3.0.0, =1.0.0, =3.0.3 - @astro-sports-developers/shared 0.0.3 and more Source cves: CVE-2026-54266 Source advisory: OSV:GHSA-39PV-4J6C-2G6V...

GHSA-692R-GRFM-V8X7 @angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

An issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism createComponent failed to reject mounting components directly onto a or namespaced script element such as . This...

The vulnerability of the Enterprise browsers’ components, Google Chrome and Microsoft Edge, allows attackers to enhance their privileges.

The vulnerability of the Enterprise browsers’ components in Google Chrome and Microsoft Edge is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...