CVE-2026-85547

CVE-2026-85547 is a cross-site request forgery (CSRF) vulnerability in MISP (Malware Information Sharing Platform). The root cause is that MISP's _isRest() check disables form-security and CSRF protections when a request is identified as REST, but this detection can be manipulated by an attacker-...

CVE-2026-84504

fastify versions before 5.12.2 are vulnerable to a request body replacement flaw caused by an Ajv async validator result collision. When a request that passes its route schema contains a root-level property named value, fastify treats that property as the value result protocol used by custom vali...

CVE-2026-85541

DreamMaker developed by Interinfo contains a Reflected Cross-site Scripting (XSS) vulnerability. Authenticated remote attackers can execute arbitrary JavaScript in a victim's browser via a malicious website. The CVSS 3.1 base score is 5.4 (MEDIUM) with a changed scope, requiring low privileges an...

CVE-2026-85540

DreamMaker , a product developed by Interinfo , is affected by a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents. The vulnerability is rated HIGH with a CVSS v3.1 base score of 8.8 (network vector, low com...

CVE-2026-85546

MISP is affected by a cross-site request forgery (CSRF) vulnerability in its sharing group quick-edit functionality. The root cause lies in the __initialiseSGQuickEdit() helper, where the allowMethod(['post']) call was commented out, allowing the addOrg, removeOrg, addServer, and removeServer act...

CVE-2026-27086

CVE-2026-27086 affects the WordPress WoodMart theme by Xtemos , versions before 8.3.8 . The vulnerability is a DOM-Based Cross-Site Scripting (XSS) caused by improper neutralization of input during web page generation. The CVSS 3.1 score is 6.5 (Medium) , with a changed scope and low impact on co...

CVE-2026-85184

@fastify/middie (a Fastify plugin for HTTP middleware) versions 9.1.0 through 9.3.3 are affected by a path-scoped middleware bypass. The root cause is a mismatch: middie evaluates the raw request target to decide whether to run path-scoped middleware, while the Fastify router resolves an absolute...

CVE-2026-85538

CVE-2026-85538 is an incorrect authorization vulnerability in MISP , where attribute deletion paths in MispAttribute::deleteAttribute() relied solely on organization membership checks without enforcing MISP's ACL::canModifyEvent() authorization logic. An authenticated user with organization membe...

CVE-2026-81665

Corosync's Totem Process Group (totempg) suffers from a heap-based buffer overflow in its fragmented multicast message reassembly path. In release builds, the reassembly buffer lacks a runtime bounds check, allowing a network-adjacent attacker to send crafted multicast protocol messages that over...

CVE-2026-81302

CVE-2026-81302 is currently a reserved candidate with no publicly disclosed technical details. The only record is a sighting linked to JVN (Japan Vulnerability Notes). Monitor for updates as the reserving organization publicizes the vulnerability.

CVE-2026-85533

CVE-2026-85533 is an authorization bypass in MISP (Malware Information Sharing Platform). In attribute attachment/editing and Galaxy Cluster creation/editing workflows, the Sharing Group authorization check was only executed when the distribution field was explicitly set to 4. By omitting or mani...

CVE-2026-27432

The WP Rentals WordPress theme by sc Internet Vivoo is affected by an Authorization Bypass Through User-Controlled Key vulnerability (classified as an Insecure Direct Object Reference / IDOR ) in versions before 3.16.0 . The flaw allows exploitation of incorrectly configured access control securi...

CVE-2026-85528

Snowflake JDBC Driver versions 4.2.0 through 4.3.3 are affected by improper input validation of the auto-configuration account identifier, allowing a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint . An attacker who controls the account value can cause the...

CVE-2026-15937

Checkmk versions prior to 2.5.0p10 contain an improper certificate validation flaw in agent receiver endpoints . The endpoints fail to verify that a presented mTLS certificate was issued by their own root certificate. As a result, a relay and a push agent that share the same UUID can reuse each o...

CVE-2026-85525

This CVE affects the Snowflake Python, Go, JDBC, and Node.js drivers . The root cause is improper OCSP response validation : OCSP responses were not reliably bound to the certificate being validated, and definitive verification failures were treated as transient errors rather than hard failures. ...

CVE-2026-57777

Automattic WooCommerce (WordPress plugin) versions prior to 11.0 are affected by a Blind SQL Injection vulnerability in the plugin's handling of special elements in SQL commands. The vulnerability is rated CVSS 3.1: 7.6 (HIGH) , with an attack vector of network , low complexity , and high privile...

CVE-2026-85311

CVE-2026-85311 is a Missing Authorization (Broken Access Control) vulnerability in the MarketKing WordPress plugin by Kings Plugins, affecting versions up to 2.1.60 . The flaw allows an unauthenticated remote attacker to exploit incorrectly configured access control security levels, resulting in ...

CVE-2026-32480

CVE-2026-32480 affects the WCFM Membership WordPress plugin (by WC Lovers) in versions up to and including 2.11.11 . The vulnerability is a missing authorization (broken access control) flaw that allows exploitation of incorrectly configured access control security levels. The CVSS v3.1 score is ...

CVE-2026-85197

libsoup contains a heap use-after-free in its HTTP/2 client implementation, specifically in the on_data_read() function. The vulnerability is triggered when a GNOME application uploads a file over HTTP/2 and a malicious server or MITM attacker sends a GOAWAY frame while the file body is still bei...

CVE-2026-6217

Pik Online Portal (by Pik Online Software Solutions Inc.) is vulnerable to information disclosure via use of a one-way hash without a salt , allowing cryptanalysis of hashed data. The issue affects versions through 3.5.1 . The CVSS 3.1 score is 6.3 (MEDIUM) , with a network attack vector, low com...