CVE-2026-16441

A flaw was found in Eclipse OpenJ9. When executing specially crafted class files, the Java Virtual Machine JVM incorrectly delegates method calls from a recompiled abstract superclass method to an interface default method. This can lead to unexpected program behavior and potential data integrity...

CVE-2026-66494

The vulnerability CVE-2026-66494 affects Joomla SP Page Builder via the Shapes API endpoint in the joomshaper Shapes extension, where unauthenticated stored XSS is possible in SP Page Builder versions before 6.7.0. An attacker can store malicious JavaScript in the Joomla site’s database with a si...

CVE-2026-49007

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...

CVE-2026-49007

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...

EUVD-2026-54408

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...

CVE-2026-49007

CVE-2026-49007 affects the ZTE F689 device. The issue arises from unencrypted information in the device firmware, enabling an attacker to obtain the initial login credentials for the web interface. Root cause: firmware exposes credentials in plaintext or unprotected form. Impact: credential discl...

CVE-2026-49007 Information leakage vulnerability in ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...

CVE-2026-49007 Information leakage vulnerability in ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...

CVE-2026-14943 Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

CVE-2026-11907

The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-11907

The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and...

OESA-2026-3271 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

EUVD-2026-54278

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench1model function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger ...

EUVD-2026-54127

Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

EUVD-2026-54114

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

EUVD-2026-54274

A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument...

EUVD-2024-55713

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution...

CVE-2026-49007: Use of Hard-coded Credentials

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...

The vulnerability in the web interface of the Cisco Integrated Management Controller (IMC) allows a perpetrator to execute arbitrary commands and increase their privileges.

The vulnerability of the Cisco Integrated Management Controller IMC’s web management interface is related to improper validation of request parameters. Exploiting this vulnerability allows an attacker to execute arbitrary commands and elevate their privileges to the root level...

MiracleLinux 9 : perl-DBI-1.643-9.el9_8.1 (AXSA:2026-1486:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1486:01 advisory. DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution CVE-2026-9698 Tenable has extracted the preceding description block directly...