CVE-2026-39110

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the contactno parameter of the forgot password page forgot-password.php. This allows an unauthenticated attacker to manipulate backend SQL queries during authentication and retrieve...

CUPS Server Unauthorized Access

The vulnerability of the cupsd server printing service in CUPS is related to deficiencies in the authentication process. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to protected information...

ANGLE Library Data Compromise

The vulnerability of the ANGLE library in Google Chrome browsers is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Linux IPv6 Kernel Heap Buffer Overflow DoS

The vulnerability of the ip6addrlblputmsg function in the net/ipv6/addrlabel.c module of the Linux operating system’s IPv6 kernel implementation is related to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to gain access to protected information or cause...

[SECURITY] [DLA 4538-1] perl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4538-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler April 18, 2026 https://wiki.debian.org/LTS -...

LDAP Injection

Bouncy Castle BC-JAVA is vulnerable to LDAP Injection.The vulnerability is due to improper sanitization of user-supplied input in the LDAPStoreHelper component, which allows an attacker to inject malicious LDAP queries and manipulate directory lookups or retrieve unauthorized data...

CVE-2026-40525 OpenViking < 0.3.9 Authentication Bypass via VikingBot OpenAPI

OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route surface where the authentication check fails open when the apikey configuration value is unset or empty. Remote attackers with network access to the exposed service can invoke...

FortiClient EMS CVE-2026-21643 exposure detection

Conservatively detects likely exposure to CVE-2026-21643 by checking that FortiClient EMS is exposed, that /api/v1/initconsts is reachable without authentication, that SITESENABLED appears true, and that the visible version is exactly 7.4.4. No SQL injection payloads are sent. !/usr/bin/env pytho...

Google Chrome Skia Unauthorized Access

The vulnerability of Google Chrome’s Skia graphics library is related to reading data beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Google Chrome FileSystem API

The vulnerability of the Google Chrome browser’s FileSystem API relates to the use of memory after it is released. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2026-40575

creationtimestamp| type| source ---|---|--- 2026-04-16 11:06:42+00:00| seen| https://ccb.belgium.be/advisories/warning-critical-authentication-bypass-oauth2-can-lead-unauthorized-data-access-patch 2026-04-22 01:19:23+00:00| seen| Telegram/LUR06ONloRlViUIW27ojzHZG9BE33b4Dag-8VffcgXgN8 2026-04-22...

SAP Business Planning and Consolidation SQL Injection

The vulnerability of the SAP Business Planning and Consolidation system for managing financial indicators, as well as the SAP Business Warehouse data management and analytics system, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can all...

CVE-2026-20059

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate...

Nextcloud: Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups

A critical broken access control vulnerability was discovered in the Team Folders application. An API-only delegated administrator was able to bypass folder-level authorization and grant access to arbitrary groups through an unprotected endpoint. Folder IDs were found to be predictable through...

Vulnerabilities in Microsoft Windows

Microsoft has fixed vulnerabilities in Windows. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: - Denial-of-Service DoS - Manipulation of data - Accessing sensitive data - Execution of arbitrary code user privileges -...

CVE-2026-39842

OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval...

EUVD-2026-22794

Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to access sensitive files or data on the system. Exploitation of this issue requires user interactio...

CVE-2026-30615

A prompt injection vulnerability in Windsurf version 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. The flaw is triggered when the application processes attacker-controlled HTML content , which can lead to unauthorized modification of the local MCP configurati...

CVE-2026-33703

Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference IDOR vulnerability in the /social-network/personal-data/userId endpoint allows any authenticated user to access full personal data and API tokens of arbitrary users by modifying the userId...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in several Office products. A malicious party could exploit the vulnerabilities to bypass security measures, impersonate another user and thus gain elevated privileges and access to sensitive data. For successful abuse, the malicious party must trick the victim...