EUVD-2026-76857

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

CVE-2026-90539 WWBN AVideo Missing Authentication via menuItems.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

PT-2026-90644

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/menuItems.json.php endpoint that allows unauthenticated attackers to read inactive admin menu items by submitting a POST request with a menuId parameter...

CVE-2026-68528: Improper Neutralization of Input During Web Page Generation

Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including...

CVE-2026-38626: Improper Neutralization of Special Elements used in an SQL Command

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php...

JetBrains TeamCity 2021.2 - 2022.10 Improper Access Control (CVE-2022-44622)

The version of JetBrains TeamCity installed on the remote host is version 2021.2 up to but not including 2022.10. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive CVE-2022-4462...

DEBIAN-CVE-2026-80918

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetchitem is called by hidscanreport on an item with HIDITEMTAGLONG, it stores a pointer to the item data in item-data.longdata instead of storing a value directly i...

CVE-2026-80918

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetchitem is called by hidscanreport on an item with HIDITEMTAGLONG, it stores a pointer to the item data in item-data.longdata instead of storing a value directly i...

CVE-2026-80918 HID: core: fix number/pointer type confusion on long items

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetchitem is called by hidscanreport on an item with HIDITEMTAGLONG, it stores a pointer to the item data in item-data.longdata instead of storing a value directly i...

PT-2026-89088

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetch item is called by hid scan report on an item with HID ITEM TAG LONG, it stores a pointer to the item data in item-data.longdata instead of storing a value...

UBUNTU-CVE-2026-84383

GHSA-g89c-p67h-r497: Heap buffer overflow in scalenearestneighbor via duplicate Alpha planes from nested iden/auxl items...

NPM: Orval: Import-time RCE via array-items default -> zod module-level template literal

NPM: Orval: Import-time RCE via array-items default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

Orval: Import-time RCE via array-items default -> zod module-level template literal

Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

PodcastGenerator 3.2.9 Cross Site Scripting

PodcastGenerator version 3.2.9 contains a persistent cross site scripting vulnerability in the Live Items functionality. Exploit Title: PodcastGenerator 3.2.9 - Stored XSS Date: 2026-08-08 Exploit Author: Sahil Arya Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator Software...

CVE-2026-81194 MasterStudy LMS < 3.7.46 - Subscriber+ Cross-Instructor Order Data Disclosure via author_id Parameter

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier...

PodcastGenerator 3.2.9 - Stored XSS

Exploit Title: PodcastGenerator 3.2.9 - Stored XSS Date: 2026-08-08 Exploit Author: Sahil Arya Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator Software Link: https://github.com/PodcastGenerator/PodcastGenerator Version: 3.2.9 Tested on: Windows 11 / XAMPP CVE : CVE-2025-7033...

CVE-2026-78076

Helix Ultimate (joomshaper.com), a Joomla template/extension, is affected in versions below 2.2.10 . The vulnerability is a Broken Access Control issue in the MegaMenu Settings feature: the AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edi...

CVE-2026-81030

Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mageai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling...

EUVD-2026-66606

Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mageai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling...

CVE-2026-81030 Mage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser_items Endpoint

Mage AI does not confine the paths accepted by its browser-items API to the project directory. BrowserItemResource in mageai/api/resources/BrowserItemResource.py passes a caller-supplied path to the filesystem read and write helpers without calling the containment helper that the sibling...