CVE-2026-18590: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in Wavlink WL-NU516U1 708c073-mt7628. Affected is the function setsysadm of the file adm.cgi of the component Admin Password Handler. This manipulation causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly...

CVE-2026-18632: Improper Neutralization of Special Elements Used in a Template Engine

A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/codeexecutor/jinja2/jinja2transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used i...

CVE-2026-18606: Improper Privilege Management

A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown functionality of the file C:\Program Files x86\Razer\RzUpdateEngineService\RzUpdateService.exe of the component Named Pipe Handler. Executing a manipulation of the argument...

CVE-2026-18646: Improper Limitation of a Pathname to a Restricted Directory

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has...

CVE-2026-68930: Operation on Resource in Wrong Phase of Lifetime

Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed in russh/src/server/encrypted.rs, serverreadauthenticated, and the execrequest callback. Version 0.62.5 fixes the issue...

PT-2026-67141

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function Reporting RCBWriteAccessHandler of the file src/iec61850/server/mms mapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory no...

CVE-2026-18582: Free of Memory not on the Heap

A security flaw has been discovered in mz-automation libiec61850 up to 1.6.1. This vulnerability affects the function ReportingRCBWriteAccessHandler of the file src/iec61850/server/mmsmapping/reporting.c of the component Report Sending Path Handler. The manipulation results in free of memory not ...

Linux Distros Unpatched Vulnerability : CVE-2026-67298

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions 3.28.0 and earlier contain a heap buffer overflow in the server-side RAIL channel handler railserverhandlemessages in...

CVE-2026-8457: Authentication Bypass by Alternate Name

The WooCommerce - Social Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to and including 2.8.7. This is due to the plugin's Apple login handler accepting the Apple idtoken and decoding only its base64 payload without verifying the JWT signature against Apple'...

CVE-2026-15385: Improper Neutralization of Input During Web Page Generation

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...

CVE-2026-67339

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle...

UBUNTU-CVE-2026-67339

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle...

CVE-2026-67339 guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle...

CVE-2025-71402

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature e.g., via...

CVE-2026-15450 NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

CVE-2026-15450

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in versions up to, and including, 9.2.3. This is due to the deletefile AJAX handler retrieving a file path from the database and passing it directly to unlink with no...

Security Bulletin: There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-44249)

Summary There is a vulnerability in netty-handler-4.1.133.Final.ja used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-44249 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In...

DoS (Denial of Service) io.netty:netty-handler Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 6.2.0, 6.3.6, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

Improper Authorization io.netty:netty-handler Dependency in Crowd Data Center

This High severity Improper Authorization vulnerability was introduced in versions 6.2.0, 6.3.6, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This Improper Authorization vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H allows an...

MITM (Man-in-the-Middle) io.netty:netty-handler Dependency in Crowd Data Center

This High severity MITM Man-in-the-Middle vulnerability was introduced in versions 6.2.0, 6.3.6, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This MITM Man-in-the-Middle vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N allows an...