CVE-2026-13365 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2026-73481

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...

GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE

A newly disclosed zero-day flaw in GeoServer is seeing active exploitation efforts, per watchTowr. The vulnerability, which has yet to be assigned a CVE identifier, is an SQL injection vulnerability in the open-source platform that can lead to remote code execution RCE. The security defect remain...

internal-privesc-poc

Internal Privilege Escalation POC Library This library provid...

.NET: .NET Core: .NET Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-19710

A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/viewdepartment.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carri...

CVE-2026-15994

Technical details (affected product, versions, root cause, and exploit scenarios) are not publicly available in the provided documents. Monitor for updates from Lenovo and CVE/NVD records.

PT-2026-71874

A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack...

ROS-20260813-73-0048

The vulnerability in uriparser is related to an uncontrolled recursion. Exploiting this vulnerability can allow attackers to cause service failures...

VulnCheck KEV: CVE-2025-55583

D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a preapiarg parameter that is passed directly to system-level shell execution functions without...

CVE-2026-64382 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64382 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-68209 affecting package kernel for versions less than 6.6.150.1-1

CVE-2026-68209 affecting package kernel for versions less than 6.6.150.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64352 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64352 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-64189 affecting package kernel for versions less than 6.6.145.2-1

CVE-2026-64189 affecting package kernel for versions less than 6.6.145.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-10534 IBM® Db2® is vulnerable to buffer overflow in the IXF IMPORT parser

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser...

GHSA-W7CW-XP7H-6J5J vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

EUVD-2026-57516

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges such as enforcing restricted.containers.privilege=isolated, LXD fails to enforce the...

ECHO-1A92-FEB4-84CA

Bulletin has no description...

CVE-2026-19147 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-18962

The vulnerability CVE-2026-18962 affects the WP Photo Album Plus WordPress plugin (pre-9.2.09.002). The issue is improper authorization during front-end uploads: any authenticated user (e.g., Subscriber) can upload files into albums owned by other users or the admin because the plugin does not ve...