CVE-2026-63635

OpenImageIO , a toolset for reading and writing image files used in VFX/animation, is affected by an out-of-bounds read in its PSD image input handler (src/psd.imageio/psdinput.cpp). When oiio:rawcolor or psd:rawdata is enabled, a crafted PSD file with an invalid color_mode bypasses validation in...

EUVD-2026-83122

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, A crafted cineon file can supply a numberofelements value greater than the format maximum of eight. cineoninput::open...

CVE-2025-14754 IBM Cloud Pak for Data is vulnerable to OS command injection

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...

EUVD-2025-210937

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...

CVE-2025-14754 IBM Cloud Pak for Data is vulnerable to OS command injection

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...

Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix

A flaw was found in Apache Tomcat. This improper input validation vulnerability stems from an incomplete fix for a previous security issue CVE-2025-66614. This flaw may allow an attacker to bypass security controls or cause unexpected behavior within the application...

CVE-2026-11757

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...

EUVD-2026-82771

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association Website: through 18092026. NOTE: The vendor was contacted early about this...

CVE-2026-11757

A Reflected Cross-Site Scripting (XSS) vulnerability exists in the KA Informatics Technologies Ltd. Co. Bar Association Website , caused by improper neutralization of input during web page generation. The affected version range extends through 18/09/2026 . The CVSS 3.1 score is 6.1 (MEDIUM) , wit...

CVE-2026-93485

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1...

Chromium CVE-2026-91738: Improper input validation

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releaseshttps://chromereleases.googleblog.com/2026 for more information...

SUSE CVE-2026-57173

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the inputaudio handling path for /v1/chat/completions calls AudioMediaIO.loadbytes or AudioMediaIO.loadfile without passing VLLMMAXAUDIODECODEDURATIONS to the shared audio decoder. An unauthenticated client can...

SUSE CVE-2026-68498

StreamReadConstraints.maxNameLength default 50,000 characters is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength default 100,000,000 characters that bounds ordinary string values. For parsers bui...

SUSE CVE-2026-93146

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

PT-2026-95492

Name of the Vulnerable Software and Affected Versions AnyCable versions prior to 1.6.15 Description The Pusher-compatible REST API in pusher/http.go includes the caller-supplied body md5 value in the HMAC input but fails to calculate the digest of the received request body or compare it with the...

CVE-2026-61794: Improper Input Validation

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbiddenannotationsregex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating...

CVE-2026-17576: Improper Neutralization of Special Elements used in an SQL Command

The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the getcomments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWPMMBComment::getcomments...

CVE-2026-14855: Improper Neutralization of Input During Web Page Generation

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

ColdFusion Code Execution

The vulnerability of the ColdFusion software platform is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-95436

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Data version 5.1.2 Description An authenticated user can execute arbitrary commands with elevated privileges on the system. This is caused by improper validation of user supplied input. Recommendations At the moment, there is...