CVE-2026-67244

A format string vulnerability in ADM’s Notification OAuth settings is triggered by user-controlled notification configuration input that is processed via an unsafe format-string operation. Exploitation requires authenticated administrator privileges and can disclose memory information or cause de...

CVE-2026-11877 Missing Authorization Vulnerability in OpenText Access Manager

An unauthorized user can modify configuration through API calls that affects the OpenText Access Manager. This issue affects Access Manager before 5.1.3...

CVE-2026-4300 Robo Gallery <= 5.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Loading Label' Setting

The Robo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Loading Label' setting in all versions up to, and including, 5.1.3. The plugin uses a custom |...| marker pattern in its fixJsFunction method to embed raw JavaScript function references within JSON-encoded...

CVE-2026-22597 Ghost has SSRF via External Media Inliner

Ghost is a Node.js content management system. In versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3, a vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF...

PT-2024-34191 · WordPress · Bold Page Builder

Name of the Vulnerable Software and Affected Versions: Bold Page Builder versions through 5.1.3 Description: The issue is related to missing authorization, allowing exploitation of incorrectly configured access control security levels. This could potentially lead to site compromise...

Out-of-bounds read vulnerability in multiple Apple products (CNVD-2019-02759)

Apple iOS is an operating system developed for mobile devices; watchOS is a smartwatch operating system. An out-of-bounds read vulnerability exists in the Core Media component in Apple iOS before 12.1.3, watchOS before 5.1.3, and macOS. An attacker can exploit the vulnerability to elevate...