EUVD-2026-13093

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all versions up to, and including, 1.6.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

CVE-2026-3658

CVE-2026-3658 affects the WordPress plugin chain for the Appointment Booking Calendar (Simply Schedule Appointments Booking Plugin). The Wordfence detail confirms a SQL Injection via the fields parameter in all versions up to 1.6.10.0, caused by insufficient escaping of user-supplied input and in...

CVE-2025-13995 IBM QRadar SIEM Information Disclosure

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 could allow an attacker with access to one tenant to access hostname data from another tenant's account...

EUVD-2025-208850

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 could allow an attacker with access to one tenant to access hostname data from another tenant's account...

CVE-2025-13995

CVE-2025-13995 affects IBM QRadar SIEM 7.5.0 up to 7.5.0 UP14, where an attacker with access to one tenant could access hostname data from another tenant. IBM IBM QRadar SIEM stores tenant-scoped information and vulnerabilities stem from insufficient tenant isolation (CWE-286). The IBM Security B...

CVE-2026-3579: Observable Discrepancy

wolfSSL 5.8.4 on RISC-V RV32I architectures lacks a constant-time software implementation for 64-bit multiplication. The compiler-inserted muldi3 subroutine executes in variable time based on operand values. This affects multiple SP math functions sp256mul9, sp256sqr9, etc., leading to a timing...

PT-2026-26351

Azure Data Factory Information Disclosure Vulnerability CVE: CVE-2026-23659 PT-Identifier: PT-2026-26351 Vendor: Microsoft Product: Azure Data Factory CVSS: 8.6 Credits: n/a Description: Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attack...

CVE-2026-33410: Incorrect Authorization

Discourse is an open-source discussion platform. Versions prior to 2026.3.0-latest.1, 2026.2.1, and 2026.1.2 have two authorization issues in the chat direct message API. First, when creating a direct message channel or adding users to an existing one, the targetgroups parameter was passed direct...

PT-2026-26241

CVE-2025-13995 IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 could allow an attacker with access to one tenant to access hostname data from another tenant's account. https://t.co/sbkrRzUCgM...

The vulnerability of the software for interacting with servers via cURL, related to deficiencies in authentication procedures, allows attackers to compromise the confidentiality of protected information.

The vulnerability of the software for interacting with servers via cURL is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality of the protected information...

The vulnerability in the Graphics component of Mozilla Firefox, Firefox ESR, and the email client Thunderbird, which allows for the disclosure of protected information

The vulnerability of the Graphics component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

CVE-2026-32736

The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. An Insecure Direct Object Reference IDOR vulnerability in versions of the wiki prior to 1.0.0 exposes mod authors' personal information - including full names and email addresses - to any authenticated...

CVE-2026-32736 Hytale Modding Wiki has Insecure Direct Object Reference / GDPR PII Exposure

The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. An Insecure Direct Object Reference IDOR vulnerability in versions of the wiki prior to 1.0.0 exposes mod authors' personal information - including full names and email addresses - to any authenticated...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in HTTPResult in SimpleHTTPClient.java, when following redirects. An attacker can obtain the contents of "Location: response" headers included in client redirects...

CVE-2026-32610

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets alloworigins="" combined with allowcredentials=True. When both of these options are enabled together, Starlette's CORSMiddlewa...

CVE-2026-32610

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets alloworigins="" combined with allowcredentials=True. When both of these options are enabled together, Starlette's CORSMiddlewa...

CVE-2026-32610

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, the Glances REST API web server ships with a default CORS configuration that sets alloworigins="" combined with allowcredentials=True. When both of these options are enabled together, Starlette's CORSMiddlewa...

CVE-2026-2991

The CVE-2026-2991 affects the KiviCare – Clinic & Patient Management System (EHR) WordPress plugin (

CVE-2026-2991 KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the patientSocialLogin function not verifying the social provider access token before authenticating a user. This makes it...

org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive informatio...