CVE-2026-12943: Improper Neutralization of Special Elements used in an OS Command

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments HMC and Novalink could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied...

CVE-2026-14980: Improper Privilege Management

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled...

CVE-2026-16727: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent Execution using Shared Resource with Improper Synchronization “Race Condition” in ASUS Armoury Crate allows a local user to execute arbitrary code with elevated privileges via a crafted file replacement. Refer to the ' Security Update for ASUS Armoury Crate ' section on the ASUS Securi...

CVE-2026-18107

A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the...

CVE-2026-18107 Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the...

CVE-2026-18107

A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the...

CVE-2026-18107 Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the...

PT-2026-65571

Name of the Vulnerable Software and Affected Versions CRIU affected versions not specified Description An issue exists in the handling of restartable sequences rseq during the checkpoint/restore process. A malicious process within a container can register an rseq critical section to hijack the...

EUVD-2026-49547

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges...

CVE-2026-43750

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges...

CVE-2026-65893

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism. Successful...

CVE-2026-65893

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism. Successful...

EUVD-2026-49064

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged...

PT-2026-65158

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 Description A buffer overflow occurs due to insufficient bounds checking. This flaw allows an application to execute arbitrary code...

CVE-2026-43750: Buffer Copy without Checking Size of Input

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges...

CVE-2026-12497 ProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and...

CVE-2026-16804

A flaw was found in Google Chrome. A remote attacker, who has already compromised the browser's renderer process, could exploit a use-after-free vulnerability. This can be achieved by enticing a user to visit a specially crafted HTML page. Successful exploitation could allow the attacker to perfo...

PT-2026-64237

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and...

PT-2026-64422

Name of the Vulnerable Software and Affected Versions Weintek cMT3092X affected versions not specified Description The Weintek cMT3092X HMI contains a flaw where it relies on cookies without proper validation and integrity checking during security decisions. This allows a non-privileged user to...

CVE-2026-65897

Grav API Plugin before 1.0.10 is affected. The flaw in InvitationsController::create() fails to validate the groups field, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. When such invitations are accepted, the new account gain...