CVE-2026-108104 Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFramedInputStream

Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared...

CVE-2026-94064

Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5...

CVE-2026-94065

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3...

CVE-2026-85479

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it...

CVE-2026-105281

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system...

CVE-2026-94065 WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3...

CVE-2026-94064 WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5...

EUVD-2026-95784

Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue affects Neo | Barber Shop WordPress Theme: from n/a through 3.5...

EUVD-2026-95785

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: from n/a through 1.3...

CVE-2026-94064

The BuddhaThemes Neo | Barber Shop WordPress Theme (neocut) is vulnerable to PHP Object Injection due to the Deserialization of Untrusted Data (CWE-502). This vulnerability affects versions up to and including 3.5 . Successful exploitation can lead to significant impacts on confidentiality , inte...

CVE-2026-94065

The BuddhaThemes ColorFolio WordPress theme (versions

EUVD-2026-95781

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it...

CVE-2026-85479 Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it...

CVE-2026-85479

The Grid Protection Alliance openPDC and openHistorian software products are affected by CVE-2026-85479 . The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. This allows an unauthenticated network attacker to connect to the int...

EUVD-2026-95780

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system...

CVE-2026-105281 Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system...

CVE-2026-105281

The Grid Protection Alliance openPDC software is vulnerable to missing authentication for a critical function. Specifically, the internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to t...

CVE-2026-100730

The Grid Protection Alliance openPDC and openHistorian software products contain a vulnerability in their service console interface. The flaw allows for the deserialization of untrusted data from a client-supplied data structure. On systems without Windows Authentication, an unauthenticated netwo...

EUVD-2026-95777

ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the orderby parameter because ProcessMaker\Traits\TaskControllerIndexMethods::applyColumnOrdering concatenates a...

Malicious code in pxnpm (npm)

pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...