CVE-2026-118173: Improper Input Validation

MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags. When a feed event or its attributes carried tags belonging to a required taxonomy for example, TLP, the guard only verified that at least one tag of that...

Google Compute Engine authorization issue vulnerability

Versions of Google Compute Engine prior to 2026-08-31 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks in the disks.createSnapshot and regionDisks.createSnapshot APIs, potentially allowing authenticated attackers to steal cross-project disk...

MISP Project misp-guard input validation error vulnerability

Versions of MISP prior to misp-guard 1.4 contain a security vulnerability. This vulnerability stems from incomplete validation checks on required taxonomy tags; only one tag is verified against an allowed list, while all tags are not. As a result, highly sensitive data may bypass policy...

Dell PowerProtect Data Domain Virtual Edition command injection vulnerability

Versions 7.7.1.0 through 8.7, LTS2024 versions 7.13.1.0 through 7.13.1.70, LTS2025 versions 8.3.1.0 through 8.3.1.30, and LTS2026 versions 8.6.1.0 through 8.6.1.10 are affected by a command injection vulnerability. This vulnerability stems from a process control issue, and high-privilege attacker...

WordPress Advanced Custom Fields: Extended plugin <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure vulnerability

Missing Authorization to Unauthenticated Data Exposure vulnerability discovered by Jay in WordPress Plugin ACF Extended versions = 0.9.2.7...

CVE-2026-116662: Improper Handling of Highly Compressed Data (Data Amplification)

Tanium addressed a compression bomb vulnerability in Enforce...

REDAXO CMS core cross-site request forgery vulnerability

REDAXO CMS versions prior to core 5.21.3 contain a cross-site request forgery vulnerability. This flaw stems from the structure/history plugin’s failure to validate GET requests, making it susceptible to such attacks. It could allow attackers to trick logged-in users into triggering func=clearall...

Dell PowerProtect Data Domain path traversal vulnerability

Versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20 of Dell PowerProtect Data Domain contain a path traversal vulnerability. This vulnerability stems from improper path handling and may allow high-privilege attackers with local access t...

CVE-2026-93434: Improper Input Validation

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request...

PT-2026-126438

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacke...

CVE-2026-116679: Incorrect Authorization

Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicithosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost evaluates host status incorrectly. An...

Qt buffer error vulnerability

Buffer error vulnerabilities exist in Qt versions 4.0.0 through 6.8.8 and 6.9.0 through 6.11.2. These vulnerabilities stem from an out-of-bounds read in QTextCodec’s TSCII encoding. When the application converts text to TSCII format via QTextCodec, it may read memory outside the input buffer,...

Miroslav Šedivý n.eko authorization issue vulnerability

In Miroslav Šedivý’s n.eko version 3.0.0 through version 3.1.5, there is an authorization issue vulnerability. This vulnerability arises because when the old mode and session.implicithosting are enabled, LegacyIsHost incorrectly evaluates host status, resulting in unauthorized input via legacy...

Ryan Grove Crass processing logic error vulnerability

Versions prior to Ryan Grove Crass 1.0.8 contain a logic error vulnerability. This occurs when processing the remainder of a malformed URL; after escaping backslashes, the subsequent right parenthesis is erroneously treated as escaped, allowing declarations, style rules, or at-rules to remain...

PT-2026-126374

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url values, or image href attributes to exfiltrate page...

REDCap 17.4.3 Survey Passthru Data Import RCE Checker

REDCap versions 13.3.0 through affected pre-fixed branches contain a survey passthru and Data Import path/stream handling issue that may allow remote code execution. This tool fingerprints targets, validates public survey hashes, and probes passthru routes...

Measuring Users' Security and Privacy Concerns about Third-Party Community Bots on Discord

Third-party community-based bots are central to how social platforms such as Discord work. They moderate content, manage roles, play music, and support AI-assisted conversations across millions of servers. Yet when a bot is installed in a server, it can access messages, user profiles, and server...

Faraday 5.25.2

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use...

PT-2026-127228

Name of the Vulnerable Software and Affected Versions Crass versions prior to 1.0.8 Description Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped when consuming the remnants of a bad URL. This causes declarations, style rules, or at-rules to remain inside a bad...

PT-2026-126645

A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...