ROS-20260209-73-0023

A vulnerability in the Zlib protocol implementation of the MongoDB database management system is related to improper handling of a length parameter mismatch. Exploitation of the vulnerability could allow a remote attacker to disclose protected information...

CVE-2026-2205 WeKan Meteor Publication cards.js CardPubSubBleed information disclosure

A vulnerability was identified in WeKan up to 8.20. This affects an unknown part of the file server/publications/cards.js of the component Meteor Publication Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. Upgrading to version 8.21 is able to...

Basecamp: Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure

The vulnerability allowed for cross-tenant ActionText reference resolution and data disclosure during the account import flow. The import process did not properly verify the ownership of the referenced records before minting signed global IDs, enabling an attacker to access and disclose data from...

EUVD-2026-5579

DeepAudit is a multi-agent system for code vulnerability discovery. In 3.0.4 and earlier, there is an improper access control vulnerability in the /api/v1/users/ endpoint allows any authenticated user to enumerate all users in the system and retrieve sensitive information including email addresse...

EUVD-2026-5682

Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure...

PT-2026-6689

Name of the Vulnerable Software and Affected Versions EasyDiscuss affected versions not specified Description Access control settings for forum post custom fields are not enforced when data is output in JSON format. This results in an Access Control List ACL bypass, potentially leading to...

CVE-2025-14150

IBM webMethods Integration on prem - Integration Server 10.15 through IS10.15CoreFix2411.1 to IS11.1CoreFix8 IBM webMethods Integration could disclose sensitive user information in server responses...

CVE-2025-14150 IBM webMethods Integration Sever is affected by

IBM webMethods Integration on prem - Integration Server 10.15 through IS10.15CoreFix2411.1 to IS11.1CoreFix8 IBM webMethods Integration could disclose sensitive user information in server responses...

CVE-2026-1927

CVE-2026-1927 affects the Greenshift – animation and page builder blocks plugin for WordPress (versions up to and including 12.5.7). The root cause is a missing capability check in the greenshift_app_pass_validation() function, allowing authenticated attackers with Subscriber-level access and abo...

Mitsubishi Electric MELSEC iQ-R Series

RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker to read device data or part of a control program from the affected product, write device data in the affected product, or cause a denial-of-service condition on the affected product. 2. RECOMMENDED PRACTICES CISA...

Ilevia EVE X1 Server

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary shell commands and the disclosure of sensitive system information. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these...

CVE-2025-10314 Malicious Code Execution Vulnerability in Mitsubishi Small-Capacity UPS Shutdown Software FREQSHIP-mini for Windows

Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files EXE or DLLs in the installation directory with specially...

PT-2026-6590

Name of the Vulnerable Software and Affected Versions Edimax EW-7438RPn-v3 Mini version 1.27 Description The Edimax EW-7438RPn-v3 Mini version 1.27 allows unauthenticated attackers to access the /wizard reboot.asp API endpoint in unsetup mode. This access discloses the Wi-Fi SSID and security key...

lz4-java: lz4-java: Out-of-bounds memory operations lead to denial of service and information disclosure

A flaw was found in lz4-java. This vulnerability allows remote attackers to cause denial of service DoS and read adjacent memory via untrusted compressed input. This vulnerability affects only programs using the unsafe LZ4decompressfast API, known as the "fast" decompressor...

PT-2026-5973

Name of the Vulnerable Software and Affected Versions Tarot, Astro & Healing version 11.4.0 Description A flaw exists in the file import process that allows overwriting of critical internal files. Successful exploitation could lead to arbitrary code execution or disclosure of sensitive informatio...

coto Tarot, Astro & Healing 安全漏洞

Coto Tarot, Astro & Healing is a women’s emotional health and growth consulting platform developed by Coto Company in Singapore. Version 11.4.0 of Coto Tarot, Astro & Healing contains a security vulnerability. This vulnerability stems from an issue with file overwriting during the file import...

PT-2026-5975

Name of the Vulnerable Software and Affected Versions Comic Book Reader version 1.0.95 Description A flaw exists in the file import process of Comic Book Reader that allows for arbitrary file overwrites. Successful exploitation could lead to arbitrary code execution or the disclosure of sensitive...

CVE-2026-1801

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soupfilterinputstreamreadline logic, where libsoup accepts malformed chunk headers, such as lone line feed LF characters instead of the required...

CVE-2026-1801 Libsoup: libsoup: http request smuggling via malformed chunk headers

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soupfilterinputstreamreadline logic, where libsoup accepts malformed chunk headers, such as lone line feed LF characters instead of the required...

CVE-2025-61643

A flaw was found in MediaWiki. This vulnerability, associated with the RecentChangeRCFeedNotifier.Php program file, could allow a remote unauthenticated attacker to disclose limited information. The specific nature of the information disclosure is not detailed, but the overall impact is considere...