CVE-2026-65162: Execution with Unnecessary Privileges

NVIDIA AIStore for Linux contains a vulnerability in the legacy ETL Kubernetes PodSpec initialization API where a remote attacker may supply Kubernetes host-namespace and container-security settings. A successful exploit may lead to code execution, privilege escalation, information disclosure, da...

CVE-2026-65150: Out-of-bounds Read

NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerability mighty lead to information disclosure, data tampering, and denial of service...

CVE-2026-65149: Out-of-bounds Write

NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering...

CVE-2026-65148: Stack-based Buffer Overflow

NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service...

CVE-2026-110141: Observable Discrepancy

Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-110101: Improper Neutralization of Input During Web Page Generation

Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...

CVE-2026-65173: Missing Authentication for Critical Function

NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote attacker may submit crafted token-revocation lists. A successful exploit may lead to data tampering and denial of service...

CVE-2026-89208: Out-of-bounds Read

A vulnerability has been identified in Capital Embedded AR Classic 431-422 All versions, Capital Embedded AR Classic R20-11 All versions = V2.3, Desigo PXC00-U All versions = V2.3, Desigo PXC001-E.D All versions = V2.3, Desigo PXC100-E.D All versions = V2.3, Desigo PXC12-E.D All versions = V2.3,...

CVE-2026-93905: Deserialization of Untrusted Data

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch job instances...

CVE-2026-44415: Path Traversal: '.../...//'

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in...

PT-2026-112349

Name of the Vulnerable Software and Affected Versions Microsoft Trace Data Helper affected versions not specified Description An issue in Microsoft Trace Data Helper allows an authorized attacker to locally disclose sensitive system information to an unauthorized control sphere. Recommendations A...

CVE-2026-109703: Missing Authorization

Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1...

PT-2026-122249

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML...

Microsoft .NET: CVE-2026-83520: .NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network...

CVE-2026-97334: Improper Handling of Highly Compressed Data (Data Amplification)

The network messaging layer contained improper handling of highly compressed data affecting service availability. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including CommServe server, Web Server, Command Center, MediaAgents, clients, and...

CVE-2026-63354: Improper Neutralization of Input During Web Page Generation

Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially...

PT-2026-112581

Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally...

CVE-2026-83787: Authentication Bypass Using an Alternate Path or Channel

Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally...

VulnCheck KEV: CVE-2026-3045

The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: 1 a non-user-bound publicnonce is exposed to unauthenticated users...

VulnCheck KEV: CVE-2026-13389

The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before...