CVE-2026-65897: Improper Privilege Management

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership,...

PT-2026-63911

Unauthenticated Sensitive Data Exposure in Create by Mediavine = 2.5.3 versions...

CVE-2026-24552: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3...

CVE-2026-65490: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0...

Linux net/smc/af_smc Heap Buffer Overflow DoS

The vulnerability of the smccreate function in the net/smc/afsmc.c module of the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

EUVD-2026-42612

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration...

GO-2026-6021 File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser...

DRUPAL-CONTRIB-2026-080

This module provides a better UI for managing and selecting Media entities in a folder structure. The module doesn't sufficiently sanitize the names and descriptions of media items and folders when they are displayed in the media browser, resulting in a stored cross-site scripting XSS...

CVE-2026-65011

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-65591 n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workflow create or modify permissions can craft a malicious expression to bypass the sanitizer and achieve host-level code execution as the n8n process. The legac...

RLSA-2026:42550 Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: RDMA/mana: Remove user triggerable WARNON in manaibcreateqprss CVE-2026-46117 kernel: Bluetooth: l2cap: Add missing chan lock in...

CVE-2026-16492 umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public a...

EUVD-2026-46642

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

EUVD-2026-47509

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

EUVD-2026-47508

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

EUVD-2026-47177

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

EUVD-2026-47178

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.4-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Bas...

EUVD-2026-47074

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: Create Item Instance. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

Plone < 2.5.3 XSS

The version of Plone installed on the remote host is prior to 2.5.3. It is, therefore, affected by a cross-site scripting XSS vulnerability, in the skins/plonetemplates/defaulterrormessage.pt due to improper validation of the typename parameter to Members/ipa/createObject before returning it to...

PT-2026-63802

Name of the Vulnerable Software and Affected Versions Create by Mediavine versions prior to 2.5.4 Description An issue exists that allows for SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, specifically affecting users with contributor...