EUVD-2026-52012

A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution...

Yonyou YonBIP - Path Traversal

Yonyou YonBIP v3 and before contains a path traversal caused by improper validation in the LoginWithV8 interface of the series data application service system, letting unauthorized attackers access sensitive information. id: CVE-2025-66744 info: name: Yonyou YonBIP - Path Traversal author:...

CVE-2026-47882

When enabling Spring Boot DevTools support for a remote application target for example a Docker container or Cloud Foundry app from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret w...

CVE-2026-59941

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...

EUVD-2026-49898

Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting XSS. This issue affects UEM: 12.23.0 QF8 or earlier...

CVE-2026-18084

Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting XSS. This issue affects UEM: 12.23.0 QF8 or earlier...

PT-2026-65315

Name of the Vulnerable Software and Affected Versions miniorange otp verification versions prior to 5.5.2 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update minioran...

EUVD-2026-48445

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...

CVE-2026-50044

Pronetiqs IntraVUE, version 3.2.1a14 and earlier , has an inadequate encryption strength vulnerability that could allow an attacker to steal admin credentials via a weak hash or a pass-the-hash attack. The issue affects network-exposed components and is described with high impact on confidentiali...

EUVD-2026-48196

Subscriber Remote Code Execution RCE in Advanced Views = 3.8.11 versions...

WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by VuNBT in WordPress Plugin ShipTime: Discounted Shipping Rates versions = 1.1.1...

CVE-2026-16439 Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow

In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow...

CVE-2026-48389

DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-48389

The CVE-2026-48389 entry concerns the DNG SDK prior to or equal to version 1.7.1 2536, which is affected by a stack-based buffer overflow that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file. The ...

CVE-2026-12525

The Redux Framework WordPress plugin before 4.5.13 does not restrict which user meta keys can be written when saving custom profile fields, allowing users with at least the Subscriber role to escalate their privileges to Administrator by submitting a crafted value while updating their own profile...

PT-2026-60297

Name of the Vulnerable Software and Affected Versions NocoBase versions prior to 2.1.0-alpha.46 Description In the @nocobase/plugin-collection-sql plugin, the checkSQL function contains an incomplete keyword blacklist. This flaw fails to restrict access to PostgreSQL system catalog tables,...

GHSA-MQXV-9RM6-W8QC Ech0: ParseAcceptLanguage `_` separator bypass enables ~70x CPU amplification via Accept-Language header in i18n.Middleware

Summary Ech0's i18n middleware runs on every HTTP request and constructs a fresh goi18n.Localizer from the raw Accept-Language header without imposing any size or shape filter. goi18n.NewLocalizer calls golang.org/x/text/language.ParseAcceptLanguage on the value internally. The underlying parser...

CVE-2026-57219 RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ installations configured with management.oauthclientsecret, exposing credentials to unauthenticated callers when the...

CVE-2026-59926

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.2.1, renderadmonition in src/mistune/directives/admonition.py concatenates the Admonition directive :class: option into the HTML class attribute without escaping, allowing attribute injection and cross-site scripting even...

CVE-2026-53134 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-53134 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...