DevTools Suite Compromise Protected Information

The vulnerability in Google Chrome and Microsoft Edge’s DevTools web development tools is related to a flaw in the data source validation mechanism. Exploiting this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...

DevTools Suite DoS

The vulnerability in Google Chrome and Microsoft Edge’s DevTools web development tools is related to data type conversion errors. Exploiting this vulnerability allows a remote attacker to cause a denial of service by sending a specially crafted HTML page...

Cisco Secure Workload protection Multi-cloud Data Centers Compromise Data Compromise

The vulnerability of the Cisco Secure Workload protection mechanism for multi-cloud data centers previously known as Tetration is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a remote attacker to compromise the accessibility of protected...

Google Chrome Microsoft Edge Unauthorized Access

The vulnerability in the Downloads component of Google Chrome and Microsoft Edge is related to improper authorization. Exploitation of this vulnerability may allow a remote attacker to gain unauthorized access to protected information, as well as cause a denial of service by using a specially...

Network service Google Chrome Microsoft Edge Access Information Disclosure

The vulnerability in the Network browser services of Google Chrome and Microsoft Edge stems from insufficient input validation. Exploitation of this vulnerability enables a remote attacker to gain access to protected information via a specially crafted HTML page...

DevTools Suite Protected Information Access

The vulnerability in Google Chrome and Microsoft Edge’s DevTools web development tools is related to a flaw in the data source validation mechanism. Exploiting this vulnerability could allow a remote attacker to gain access to protected information...

Microsoft Copilot Web Data Cleansing Disclosure

The vulnerability of the Microsoft Copilot Web-based artificial intelligence conversational assistant is related to the lack of data cleansing measures at the management level. Exploiting this vulnerability can allow a malicious actor to disclose protected information...

Compatibility Subsystem Execution Linux Applications Windows WSL2

The vulnerability of the compatibility subsystem’s kernel for running Linux applications involves synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to replace data with malicious content...

Tencent AI-Infra-Guard Code Execution

The vulnerability of the Tencent AI-Infra-Guard software platform for security testing involves a flaw in the data protection mechanism. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code...

CVE-2026-104252: Improper Neutralization of Input During Web Page Generation

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML...

VulnCheck KEV: CVE-2026-8441

The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprploadmorerevs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $POST'notinstring' and passed through sanitizetextfield — which strips HTML and...

VulnCheck KEV: CVE-2025-13880

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets Google Reviews, YouTube Feed, Photo Feeds, and More plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings...

PT-2026-111712

Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET...

Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration

Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query data from other organizations within a multi-tenant Lowcoder instance. Description CVE-2026-16753...

ROS-20261013-73-0386

The vulnerability of the rtnlfillvfinfo function in the net/core/rtnetlink.c module, which is part of Linux’s kernel network functions, stems from the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

PT-2026-112635

Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally...

PT-2026-111614

The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and...

PT-2026-111401

Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Improper access control exists regarding database queries used for subnet management. An authenticated attacker can exploit this to read, modify, or delete subnet configurations, resulting ...

PT-2026-111695

Name of the Vulnerable Software and Affected Versions Koillection versions prior to 1.8.5 Description Authenticated users can upload HTML files as Datum file attachments due to a lack of MIME restrictions. An attacker can upload HTML payloads via the 'POST /api/data/id/file' endpoint, which are...

PT-2026-111723

The AVDTP signalling layer arms a 6-second command timeout AVDTP TIMEOUT in avdtp send cmd whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session-timeout work before clearing the pending request, but bt avdtp l2cap...