CVE-2026-35149

CVE-2026-35149 involves HCL DFXServer and describes an authentication bypass caused by server response manipulation. The vulnerability allows an unauthenticated attacker to gain access by intercepting and altering authentication responses, effectively bypassing verification. Reported CVSS-3.1 met...

CVE-2026-15103

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Privilege Escalation via arbitrary option update in all versions up to, and including, 3.12.8. This is due to the updatesettings REST callback failing to validate the groupid path...

CVE-2026-15103

The CVE affects the WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell WordPress plugin. All versions up to 3.12.8 are vulnerable to privilege escalation via an insecure update_settings() REST callback that does not validate the group_id path parameter against an allowlis...

CVE-2026-50144

A flaw was found in ncnn, a high-performance neural network inference framework. A remote attacker could craft a malicious model file that, when processed by a user, triggers an out-of-bounds heap write. This vulnerability in the ncnn::ParamDict::loadparam function is caused by insufficient...

MINI-4QJ2-P73Q-CWMM

Bulletin has no description...

MINI-JVG9-5MQX-H8RH

Bulletin has no description...

EUVD-2026-44894

The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pricewrapper' Shortcode Attribute in all versions up to, and including, 3.6.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-53366

creationtimestamp| type| source ---|---|--- 2026-07-16 07:43:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqqgthqbh2s 2026-07-16 17:31:03+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116930842680877521 2026-07-20 17:28:37+00:00| seen|...

BELL-CVE-2026-40553

Bulletin has no description...

ROOT-OS-DEBIAN-13-CVE-2026-23373 CVE-2026-23373 in rootio-linux - Patched by Root

Root has patched CVE-2026-23373 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-46216 CVE-2026-46216 in rootio-linux - Patched by Root

Root has patched CVE-2026-46216 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-68776 CVE-2025-68776 in rootio-linux - Patched by Root

Root has patched CVE-2025-68776 in the rootio-linux package for Root:Debian:13. Multiple fixed versions available...

CVE-2026-52960 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

CVE-2026-53447

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport or checking source-board membership. Any authenticated user who kno...

CVE-2026-55398

creationtimestamp| type| source ---|---|--- 2026-07-15 22:00:21+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpptm4mdb2w...

CVE-2026-40953

creationtimestamp| type| source ---|---|--- 2026-07-15 21:00:10+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mqpmhxmhi52n...

CVE-2026-46684

creationtimestamp| type| source ---|---|--- 2026-07-15 20:48:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqplsfbiqb2l 2026-07-16 00:24:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqpxv6enic2a 2026-07-18 04:16:04+00:00| seen|...

Improper Authentication

Apollo ConfigService is vulnerable to Improper Authentication. The vulnerability is due to improper validation of non-canonical appId values during authentication, which allows an attacker to bypass AccessKey or management key protections and gain unauthorized access to protected configuration da...

CVE-2026-48038 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

CVE-2026-52869

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and mcp.server.streamablehttpmanager.StreamableHTTPSessionManager route requests to existing...