CVE-2026-84074: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

ROS-20260918-73-0020

The vulnerability of the net/bluetooth/l2capcore.c component in the Linux operating system is related to incorrect checking of the data size at the input stage. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity...

CVE-2026-17576: Improper Neutralization of Special Elements used in an SQL Command

The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the getcomments action in versions up to, and including, 1.13.9. This is due to insufficient escaping on the array-key names supplied in the JSON request body before use in a SQL statement: IWPMMBComment::getcomments...

CVE-2026-17086: Deserialization of Untrusted Data

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and...

CVE-2026-14855: Improper Neutralization of Input During Web Page Generation

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-81180: Improper Input Validation

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker c...

Linux Distros Unpatched Vulnerability : CVE-2026-92523

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/nldev: validate dynamic counter attribute length RDMANLDEVATTRSTATHWCOUNTERS is a nested attribute whose children are consumed directly with nlagetu32. The...

PT-2026-95692

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description Improper neutralization of input during web page generation allows a remote attacker to execute arbitrary code. Recommendations At the moment, there is no information about a newer version...

CVE-2026-25684: Improper Input Validation

A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...

CVE-2026-61794: Improper Input Validation

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbiddenannotationsregex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating...

CVE-2025-36178: Improper Validation of Specified Quantity in Input

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size...

PT-2026-95303

Name of the Vulnerable Software and Affected Versions Bar Association Website versions through 18092026 Description Improper neutralization of input during web page generation leads to a Reflected Cross-Site Scripting XSS issue. Reflected XSS occurs when an application includes untrusted data in ...

CVE-2026-84070: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

PT-2026-95492

Name of the Vulnerable Software and Affected Versions AnyCable versions prior to 1.6.15 Description The Pusher-compatible REST API in pusher/http.go includes the caller-supplied body md5 value in the HMAC input but fails to calculate the digest of the received request body or compare it with the...

PT-2026-95436

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Data version 5.1.2 Description An authenticated user can execute arbitrary commands with elevated privileges on the system. This is caused by improper validation of user supplied input. Recommendations At the moment, there is...

CVE-2026-93568: Improper Input Validation

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical...

CVE-2026-93567: Improper Input Validation

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

PT-2026-95443

Name of the Vulnerable Software and Affected Versions IBM Controller versions 11.0.0 through 11.0.1 FP7 IBM Controller versions 11.1.0 through 11.1.3 FP1 Description An authenticated user can bypass input validation because the software improperly validates client-side input regarding file size...

CVE-2026-18911: Improper Input Validation

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication...

Cisco Identity Services Engine Multiple Vulnerabilities (cisco-sa-ise-mult-vul-ymSsTLCc)

According to its self-reported version, Cisco ISE is affected by multiple vulnerabilities. - A vulnerability in the SXP REST API of Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks. CVE-2026-20284 - A vulnerability in the SXP REST API of Cisco ISE could all...