ServiceNow - Incomplete Input Validation

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addresse...

EUVD-2026-51027

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-44092 Missing input validation / stripping of CRLF characters in SystemConfigManager

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-44092

CVE-2026-44092 affects the ModbusServer application. An unauthenticated remote attacker can inject malicious input because input fetched from MQTT is not validated, leading to integrity and availability loss. Root cause: lack of validation in input handling for MQTT-derived data. Reported metrics...

CVE-2026-15153

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

Vulnerabilities are handled in GitLab through GitLab Inc.

GitLab Inc. has addressed several vulnerabilities in GitLab, particularly in versions prior to 19.0.5, 19.1.3, and 19.2.1, including those of the GitLab Enterprise Edition EE. These vulnerabilities concern various aspects of GitLab: - Improper access control, allowing authenticated users to acces...

EUVD-2026-51013

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

EUVD-2026-50990

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...

CVE-2026-17735

An insufficient validation of untrusted input flaw was found in the BFCache component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=496569497...

CVE-2026-67248

A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM. The vulnerability occurs because user-controlled input is not properly validated before being decoded and copied into a fixed-size stack buffer. An authenticated attacker can exploit this issue to cause denial ...

CVE-2026-67247

A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...

CVE-2026-67246

A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit this issue to access or manipulate files outside...

OPENSUSE-SU-2026:21480-1 Security update for mcphost

This update for mcphost fixes the following issues: - CVE-2026-5160: github.com/yuin/goldmark/renderer: Cross-site Scripting due to improper URL validation bsc1272488. - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and...

CVE-2026-16610

CVE-2026-16610 , for the Admin and Site Enhancements (ASE) Pro WordPress plugin, is documented as allowing unauthenticated remote code execution in all versions up to 8.9.0 via the recursive_html function. The root cause is a vulnerable frontend save handler that relies on a publicly emitted nonc...

CVE-2026-67248

The CVE-2026-67248 issue affects ADM’s File Explorer and is caused by a stack-based buffer overflow: user-controlled input is not properly validated before decoding and copying into a fixed-size stack buffer. An authenticated attacker could deny service to the affected CGI process, with possible ...

EUVD-2026-50964

A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...

CVE-2026-67247 A path traversal vulnerability was found in the IHM Log handling of ADM

A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...

CVE-2026-67247 A path traversal vulnerability was found in the IHM Log handling of ADM

A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...

CVE-2026-67246 A path traversal vulnerability was found in the Wallpaper component of ADM

A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability occurs because user-controlled wallpaper path input is not sufficiently validated before being used for file access. An authenticated attacker can exploit this issue to access or manipulate files outside...

DEBIAN-CVE-2026-18014

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a malicious file. Chromium security severity: Low...