CVE-2026-100293

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the...

CVE-2026-100291

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations...

CVE-2026-90918

Joomla! Core - 20260908 - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions...

CVE-2026-90914

Joomla! Core - 20260904 - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts...

CVE-2026-90906

Joomla! Core - 20260901 - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper...

CVE-2026-90914

A cross-site scripting (XSS) vulnerability exists in Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 . The root cause is a lack of escaping within the generic audio and video output layouts . This flaw allows an attacker to execute malicious scripts in the context of a user's session. No specif...

CVE-2026-90914 Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260904 - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to an XSS vulnerability in the generic audio and video output layouts...

CVE-2026-90906

The Joomla! Core software is affected by an XSS vulnerability in the HTMLHelper::link method. The root cause is a lack of escaping , which allows for the execution of cross-site scripting. This vulnerability impacts Joomla versions 1.5.0-5.4.8 and 6.0.0-6.1.3 . The CVSS 4.0 score is 8.4 (HIGH) , ...

AZL-105458 CVE-2026-75804 affecting package cloud-hypervisor 52.0.152-1

Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the stream flow control limits. Impact summary: A malicious remote peer may exploit the lack of connection flow control for streams to make the...

PT-2026-102826

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the...

ROS-20260929-73-0155

The vulnerability of the hclgevfknicsetup function in the drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevfmain.c file of the Linux kernel’s Ethernet network adapter driver is related to the lack of resource initialization. Exploiting this vulnerability could allow an attacker to cause a system...

PT-2026-102690

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 4.0.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description Lack of escaping in the generic audio and video output layouts leads to a Cross-Site Scripting XSS issue. XSS is a flaw that allows an attacker to...

ROS-20260929-73-0202

The vulnerability of the adv7842cplogstatus function in the drivers/media/i2c/adv7842.c file of the Linux kernel-based multimedia device driver involves a lack of checking for the return value. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

CVE-2026-90906: Improper Neutralization of Input During Web Page Generation

Joomla! Core - 20260901 - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper...

ROS-20260929-73-0191

The vulnerability of the powerpc/kexec component in the Linux operating system is related to the lack of initialization for resources. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux Distros Unpatched Vulnerability : CVE-2026-75804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Issue summary: OpenSSL QUIC stack does not enforce connection level flow control for streams. Remote peers may send more bytes as long as they fit within the...

GO-2026-6484 Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server

Mattermost doesn't validate channel ownership of an existing subscription before applying edits in github.com/mattermost/mattermost-server...

EUVD-2026-88296

A vulnerability was discovered in Fleet's Git webhook receiver the gitjob webhook service. When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any...

CVE-2026-82932

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service. This issue was fixed in...

PT-2026-99864

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...