388282 matches found
CVE-2026-103629
An integer overflow flaw was found in the Skia component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/562038679...
CVE-2026-103621
An integer overflow flaw was found in the Compositing component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/556268833...
CVE-2026-97257
Deserialization of Untrusted Data vulnerability in PressTigers Simple Event Planner simple-event-planner allows Object Injection.This issue affects Simple Event Planner: from n/a through 1.5.7...
CVE-2026-93617
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...
CVE-2026-71299
A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity...
CVE-2026-71298
A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...
CVE-2026-71297
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...
CVE-2026-105696
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...
CVE-2026-103348
Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP Ultimate Exporter wp-ultimate-exporter allows Object Injection.This issue affects WP Ultimate Exporter: from n/a through 3.0...
CVE-2026-100511
Deserialization of Untrusted Data vulnerability in Vektor Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Object Injection.This issue affects VK Google Job Posting Manager: from n/a through 1.3.1...
CVE-2026-100506
Deserialization of Untrusted Data vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Object Injection.This issue affects WP Spell Check: from n/a through 12.1...
CVE-2026-105696 Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...
CVE-2026-105696
The Penpot design and prototyping platform is vulnerable to a page-scope escalation in versions prior to 2.18.0 . The get-page and get-file-fragment RPC commands fail to verify if a requested page-id or fragment belongs to the authorized set of a provided share-link permission object. An authenti...
CVE-2026-105696 Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blanket read access but does not verify that the caller-selected page-id belongs to the link's authorized pages set. An attacker with both a valid share link and...
CVE-2026-71297 Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...
CVE-2026-71297
A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forge...
CVE-2026-90015
A flaw was found in the Linux kernel's xHCI eXtensible Host Controller Interface driver. This vulnerability occurs when the driver processes large, fragmented USB data transfers, leading to incorrect handling of memory buffers. An attacker with local access or a malicious USB device could exploit...
Security Bulletin: As a Spring Framework applications, IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-59282)
Summary Spring framework is used by IBM Sterling Control Center as part of dependency in spring-beans-6.2.12.jar. Vulnerability Details CVEID:CVE-2026-59282 DESCRIPTION: Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target...
Security Bulletin: Due to the use of Java SE, IBM Sterling Control Center is vulnerable to multiple CVEs (CVE-2026-70906, CVE-2026-61308, CVE-2026-70907, CVE-2026-60589, CVE-2026-16440)
Summary Java SE is used by IBM Sterling Control Center as part of dependency in IBM Semeru Runtime CSPU - Aug 2026 - Includes OpenJDK August 2026 CPU. Vulnerability Details CVEID:CVE-2026-70906 DESCRIPTION: Easily exploitable vulnerability allows unauthenticated attacker with network access via...