DRUPAL-CONTRIB-2026-105

This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirel...

EUVD-2026-66272

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price...

VulnCheck KEV: CVE-2026-36425

An issue in OPSWAT AppRemover Driver ardrv.sys v2017.10.02.1551 and earlier in IOCTL handler 0x2420031. Any local user can open the device and send process termination requests without privilege validation...

ROS-20260826-73-0004

The vulnerability of the usbsharkprobe function in the drivers/media/radio/radio-shark.c module of the Linux kernel-based multimedia device driver relates to insufficient input data validation. Exploiting this vulnerability could allow an attacker to cause service failures...

PT-2026-82371

Name of the Vulnerable Software and Affected Versions CAPTCHA Protected Page versions 0.0.0 through 1.0.2 Description An authentication bypass exists in the CAPTCHA Protected Page module, which allows site administrators to require CAPTCHA confirmation on specific pages. The module fails to...

PT-2026-82364

Name of the Vulnerable Software and Affected Versions Drupal Slick Carousel versions 0.0.0 through 2.1.0 Description Improper neutralization of input during web page generation in the Slick UI sub-module allows for Stored Cross-site Scripting XSS. The issue occurs because the module does not...

The vulnerability of the set_data() function in the src/libgit2/transports/smart_pkt.c file, which implements Git methods in the C language, allows a hacker to cause a service failure.

The vulnerability of the setdata function in the src/libgit2/transports/smartpkt.c file, which implements Git methods in C language, is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause service failures...

openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages

A flaw was found in OpenSSL's Cryptographic Message Services CMS AuthEnvelopedData processing. An on-path attacker can exploit insufficient input validation on cipher and tag length fields by sending specially crafted CMS messages. This can lead to the forging of messages or bypassing integrity...

Security update for sssd

This update for sssd fixes the following issue: CVE-2026-68743: insufficient validation in the PAM responder can lead to an out-of-bounds read and a process crash when a crafted protocol v1 request is processed bsc1273925. Patch Instructions: To install this SUSE update use the SUSE recommended...

SQL Injection

ureport is vulnerable to SQL Injection. The vulnerability is due to insufficient validation of SQL statements in the /ureport/datasource/previewData component, which allows an attacker to inject crafted SQL queries and access sensitive database information...

UBUNTU-CVE-2026-56705

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when...

The vulnerability of the mcba_usb_probe() function in the drivers/net/can/usb/mcba_usb.c file of the Linux kernel’s network device support driver allows a hacker to cause a service failure.

The vulnerability of the mcbausbprobe function in the drivers/net/can/usb/mcbausb.c file of the Linux network device driver module is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the __arm_lpae_unmap() function in the drivers/iommu/io-pgtable-arm.c file of the Linux operating system’s IOMMU driver allows a hacker to trigger a service failure.

The vulnerability of the armlpaeunmap function in the drivers/iommu/io-pgtable-arm.c file of the Linux operating system’s IOMMU driver is related to insufficient validation of data authenticity. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-81187

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...

CVE-2026-71932 DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to acce...

CVE-2026-71917

Multiple DrayTek VigorSwitch models are affected by an OS command injection in the pingtrace function, caused by insufficient validation of the host field before command execution. An attacker with valid administrative credentials for the device's web management interface can supply crafted input...

EUVD-2026-64969

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

CVE-2026-71910 DrayTek VigorAP Multiple Models OS Command Injection via apautotest

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

CVE-2026-71906

DrayTek VigorAP multiple models are affected by an OS command injection in the setLan function, caused by insufficient validation of the lanIp and lanNetmask fields before they are passed to a command execution context. A remote attacker with valid administrative credentials on the device's web m...

PT-2026-80944

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...