EUVD-2026-72577

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

CVE-2026-79572

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

PT-2026-87110

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

CVE-2026-79572

The Distribution Management v1.0.0 software contains an XML External Entity (XXE) vulnerability within its level-rule module . Attackers can exploit this flaw by supplying a crafted XML payload to perform unauthorized actions, such as reading sensitive files , scanning internal networks , or laun...

CVE-2026-9331: Missing Authorization

The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcfdeletefeed function in all versions up to, and including, 1.0.2. This makes it possible for...

CVE-2026-79572

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

Android Automotive OS Update Bulletin—September 2026Stay organized with collectionsSave and categorize content based on your preferences.

The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2026-09-05 or later from the September 2026 Android Security Bulletin in addition to all issues in...

EUVD-2026-72910

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

PT-2026-86952

SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command...

PT-2026-87165

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description A security issue in the aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks. This occurs when Atlas Search feature...

CVE-2026-79572: Improper Restriction of XML External Entity Reference

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

CVE-2026-76931: Improper Neutralization of Input During Web Page Generation

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-17509: Improper Neutralization of Special Elements used in an SQL Command

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...

CVE-2026-2520: Missing Authorization

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, wit...

CVE-2026-16502: Deserialization of Untrusted Data

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

Siemens Siveillance Control

SUMMARY A vulnerability has been identified in the Open Interface Services OIS web module affecting Siveillance Control and Siveillance Control Pro versions OIS 3.x.y and OIS 4.x.y . This vulnerability allows an attacker to upload arbitrary files, which can lead to unauthorized root-level access...

EEF-CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Summary Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3...

CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...

radare2 v6.2.2

Radare2: Libre Reversing Framework for Unix Geeks Current git master branch is 6.2.4, next release will be 6.2.5. Description r2 is a complete rewrite of radare. It provides a set of libraries, tools and plugins to ease reverse engineering tasks. Distributed under LGPLv3, despite each plugin can...

CVE-2026-86426

creationtimestamp| type| source ---|---|--- 2026-09-07 14:07:46+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3muwombeul522 2026-09-08 18:08:31+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3muzmjo32o42g 2026-09-09 15:00:07+00:00| confirmed|...