CVE-2026-32610

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets alloworigins="" combined with allowcredentials=True. When both of these options are enabled together, Starlette's CORSMiddlewa...

CVE-2026-32610

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets alloworigins="" combined with allowcredentials=True. When both of these options are enabled together, Starlette's CORSMiddlewa...

CVE-2026-2991

The CVE-2026-2991 affects the KiviCare – Clinic & Patient Management System (EHR) WordPress plugin (

CVE-2026-2991 KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the patientSocialLogin function not verifying the social provider access token before authenticating a user. This makes it...

org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive informatio...

Improper Access Control

code.gitea.io/gitea is vulnerable to improper access control. The vulnerability is due to incorrect handling of API tokens with scopes limited to public resources, which allows an attacker to access private resources using a token that should only permit access to public data...

CVE-2026-32268 Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability

The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthenticated users can view a list of buckets the plugin has access to. The DefaultController-actionLoadContainerData endpoint allows...

EUVD-2025-208810

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources...

The vulnerabilities of the functions i40e_dbg_command_read(), i40e_dbg_netdev_ops_read(), and i40e_dbg_netdev_ops_write() in the driver module drivers/net/ethernet/intel/i40e/i40edebugfs.c of the Intel Ethernet network adapter driver for the Linux operating system allow a attacker to access protected information or cause service failures.

The vulnerability of the functions i40edbgnetdevopsread and i40edbgnetdevopswrite in the driver module drivers/net/ethernet/intel/i40e/i40edebugfs.c of the Intel Ethernet network adapter driver for the Linux operating system is related to reading data from memory beyond the allowed limits...

The vulnerability in the SoundWire driver’s drivers/soundwire/qcom.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability in the SoundWire driver’s qcom.c file in the Linux operating system lies in the access to memory beyond the permissible buffer data size limits, due to violations of resource configuration agreements. Exploiting this vulnerability can allow an attacker to compromise the...

The vulnerabilities of the functions hci_link_keys_clear(), hci_smp_ltks_clear(), hci_smp_irks_clear(), and hci_blocked_keys_clear() in the net/bluetooth/hci_core.c module of the Linux operating system’s Bluetooth subsystem allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the functions hcilinkkeysclear, hcismpltksclear, hcismpirksclear, and hciblockedkeysclear in the net/bluetooth/hcicore.c module of the Linux operating system’s Bluetooth subsystem is related to the reallocation of previously freed memory. Exploiting this vulnerability could...

The vulnerability of the ntfs_list_ea() function in the fs/ntfs3/xattr.c module of the NTFS file system in the Linux operating system allows a attacker to gain access to protected information or cause a service failure.

The vulnerability of the ntfslistea function in the fs/ntfs3/xattr.c module of the NTFS file system in the Linux operating system is related to reading data beyond the allowed limits of the buffer. Exploiting this vulnerability could allow an attacker to access protected information or cause...

CVE-2026-29858

A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion LFI, leadingot sensitive information exposure...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to copying buffers without checking input data, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the copying of buffers without checking the input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules, related to writing beyond the buffer limit, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to writing beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

CVE-2026-29858

A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion LFI, leadingot sensitive information exposure...

CVE-2026-26004

CVE-2026-26004 (Sentry) : A cross-organization insecure direct object reference (IDOR) exists in Sentry’s GroupEventJsonView endpoint for versions prior to 26.1.0. This could allow unauthorized access to event data across organizational boundaries. The issue is mitigated by upgrading to version 2...

CVE-2025-14806

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources...

CVE-2025-14806

IBM Planning Analytics Local 2.1.0 through 2.1.17 could allow an attacker to trick the caching mechanism into storing and serving sensitive, user-specific responses as publicly cacheable resources...

openjdk: Improve HttpServer Request handling (Oracle CPU 2026-01)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17...