EUVD-2026-63775

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...

EUVD-2026-63617

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-16520

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...

CVE-2026-16520

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects Genian NAC V4.0: from 4.0.0 before 4.0.175Revisio...

CVE-2026-16520

Genians Genian NAC V4.0, V5.0, and Genian ZTNA V6.0 contain improper input validation enabling SQL injection and authentication bypass (CVSS 8.7 HIGH). Affected versions: NAC V4.0 before 4.0.175, V5.0 before 5.0.88, ZTNA V6.0 before 6.0.48. No in-the-wild exploitation reported. Patch to the liste...

CVE-2026-70105

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-17170 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to improper validation of an allocation size...

CVE-2026-70105

CVE-2026-70105 is an improper input validation vulnerability in Microsoft Office Word that allows an unauthorized, remote attacker to disclose information over a network . The attack requires user interaction (e.g., opening a crafted document) and no prior privileges. CVSS v3.1 score is 6.5 (Medi...

EUVD-2026-63664

Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData function calls bufio.Reader.ReadBytes before applying the lendata+lenline size check to the completed SMTP DATA line against Server.MaxSize. An unauthenticated SMTP client...

EUVD-2026-63592

Improper input validation in the Time Series Visual Builder TSVB plugin in OpenSearch Dashboards allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This issue is a form of prototype pollution that enabl...

CVE-2026-18420

Improper input validation in OpenSearch Dashboards' TSVB plugin enables prototype pollution via crafted JSON to the metrics visualization API, yielding authenticated remote code execution. CVSS 3.1 scores 8.8 (HIGH). Affected versions are fixed in OpenSearch Dashboards 3.8.0. Exploitation in the ...

CVE-2026-55244

creationtimestamp| type| source ---|---|--- 2026-08-20 18:35:06+00:00| published-proof-of-concept| https://github.com/lmfit/asteval/security/advisories/GHSA-89v8-rhwq-hf77...

CVE-2026-73258 Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-73258

In Mongoose prior to 7.22, mg_http_next_multipart() in src/http.c uses an incorrect AND condition when scanning for CRLF terminators in multipart input. A lone carriage return or line feed causes premature truncation of headers, filenames, or boundaries, allowing an attacker to present a misleadi...

EUVD-2026-63495

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-18287

aeon (Python time series library, aeon-toolkit/aeon) is vulnerable to code injection in the load_time_series_segmentation_benchmark method. The root cause is the lack of proper validation of a user-supplied string before it is used to execute Python code, allowing an attacker to run arbitrary cod...

CVE-2026-63039

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to...

CVE-2026-74295

A flaw was found in the Linux kernel, specifically within the ASoC hdachdmi audio codec driver. This vulnerability occurs because the driver does not properly validate an input value used to access an internal data structure. A local attacker could provide a specially crafted input, causing the...

CVE-2026-16932

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable...

CVE-2026-16926

CVE-2026-16926 is classified as CWE-73 (External Control of File Name or Path) in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1, allowing a remote unauthenticated attacker to overwrite arbitrary files. Fixes are available via AIX Service Packs (7.2 TL05 SP13, 7.3 TL02 SP05, TL03 SP03, TL04 SP02) and V...