CVE-2026-4937

IBM PowerVM Hypervisor (FW1110.00–FW1110.20, FW1060.00–FW1060.71, FW950.00–FW950.H2) is vulnerable to insufficient entropy (CWE-331) in certain hypervisor calls, allowing a local attacker with administrative privileges to decrypt encrypted data. The CVSS 3.1 score is 5.3 (Medium) with a local att...

CVE-2026-4937 Power System Insufficient Entropy

IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 could allow a local attacker with administrative privileges to decrypt encrypted data due to certain hypervisor calls utilizing less entropy than requested...

EUVD-2026-62576

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

EUVD-2026-62567

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-20232

The web-based management interface of Cisco IE 1000 Series Switches fails to validate user-supplied input, enabling an authenticated attacker to inject malicious script into specific pages that executes in another user's session (stored XSS). CVSS 5.4 (MEDIUM) requires valid credentials and user ...

CVE-2026-73347

creationtimestamp| type| source ---|---|--- 2026-08-19 15:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mth2dxahnq2e...

gimp: GIMP: Arbitrary code execution via heap-based buffer overflow in HDR file parsing

A flaw was found in GIMP. This vulnerability, a heap-based buffer overflow, occurs during the parsing of HDR High Dynamic Range files due to insufficient validation of user-supplied data length. A remote attacker could exploit this by convincing a user to open a specially crafted malicious file,...

CVE-2026-76235

creationtimestamp| type| source ---|---|--- 2026-08-19 14:01:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/2bjmx3jmx6pfe...

CVE-2026-19490

creationtimestamp| type| source ---|---|--- 2026-08-19 13:38:22+00:00| seen| https://bsky.app/profile/samilaiho.com/post/3mtgu422mv22l 2026-08-19 15:10:10+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtgza5tnvr2m 2026-08-19 15:23:22+00:00| seen|...

CVE-2026-74402

A flaw was found in the Linux kernel's atmel-sha204a cryptographic hardware random number generator HWRNG driver. Improper buffer management in both blocking and non-blocking paths causes the driver to fail in providing valid entropy. This occurs because the buffer is read starting from byte 1, a...

Vulnerabilities in Oracle Commerce Platform

Oracle has identified several vulnerabilities in the Oracle Commerce Platform version 11.4.0. These vulnerabilities allow unauthorized attackers with network access to perform critical actions without authentication. This includes gaining unauthorized access to sensitive data, modifying, deleting...

CVE-2026-15446 EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-76004

creationtimestamp| type| source ---|---|--- 2026-08-19 04:01:20+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtftudw2qa2z 2026-08-19 04:02:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6nty3mit5tdmx 2026-08-19 04:30:25+00:00| seen|...

CVE-2026-15421

The Speed Optimizer WordPress plugin (versions ≤ 7.8.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) via image tag attributes in its Lazy Load Media feature. The root cause is insufficient input sanitization and output escaping in the lazy-load image processing code. An authenticated attac...

PT-2026-78493

A vulnerability in the web-based management interface of Cisco Industrial Ethernet IE 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of...

PT-2026-78256

Name of the Vulnerable Software and Affected Versions Speed Optimizer versions prior to 7.8.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs via image tag...

PT-2026-78502

Name of the Vulnerable Software and Affected Versions Cisco Crosswork affected versions not specified Description Multiple issues related to insufficiently protected credentials were identified during an internal security review. These issues fall under the category of CWE-522, which refers to th...

ROS-20260819-73-0044

The vulnerability in perl-Image-ExifTool is related to insufficient neutralization of special elements in the request. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-78522

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

CVE-2026-70855

creationtimestamp| type| source ---|---|--- 2026-08-18 22:21:36+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfauukqmo2e 2026-08-19 06:50:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtg5c5i2ru23 2026-08-19 17:48:06+00:00| seen|...