CVE-2026-16502: Deserialization of Untrusted Data

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.1.18 via deserialization of untrusted input . This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

Siemens Siveillance Control

SUMMARY A vulnerability has been identified in the Open Interface Services OIS web module affecting Siveillance Control and Siveillance Control Pro versions OIS 3.x.y and OIS 4.x.y . This vulnerability allows an attacker to upload arbitrary files, which can lead to unauthorized root-level access...

EEF-CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Summary Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3...

CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...

radare2 v6.2.2

Radare2: Libre Reversing Framework for Unix Geeks Current git master branch is 6.2.4, next release will be 6.2.5. Description r2 is a complete rewrite of radare. It provides a set of libraries, tools and plugins to ease reverse engineering tasks. Distributed under LGPLv3, despite each plugin can...

CVE-2026-86426

creationtimestamp| type| source ---|---|--- 2026-09-07 14:07:46+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3muwombeul522 2026-09-08 18:08:31+00:00| seen| https://bsky.app/profile/vulnsea.com/post/3muzmjo32o42g 2026-09-09 15:00:07+00:00| confirmed|...

CVE-2017-6458

creationtimestamp| type| source ---|---|--- 2026-09-07 13:15:19+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3muwlohukka2v...

CVE-2026-12853 Flamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

BIT-ELK-2026-72633 Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring

Incorrect Authorization CWE-863 in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only read-level Security feature access, and no Elasticsearch privileges, could stop the recurri...

PT-2026-88193

These are all security issues fixed in the hauler-2.1.0-3.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-86922

Improper Handling of Alternate Encoding vulnerability in ash-project ash double entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, ...

ROS-20260907-73-0011

The vulnerability in libssh is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Benchmarking LLMs for Threat Level Determination

The fast progress of large language models LLMs opens new opportunities in the management of cyber threat intelligence, but their reliability for operational tasks remains unclear. In this work, we benchmark LLMs on the task of threat level determination. First, we construct a curated dataset...

CVE-2026-86504: Inclusion of Functionality from Untrusted Control Sphere

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution...

CVE-2026-14444: Improper Privilege Management

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-2390: Improper Neutralization of Input During Web Page Generation

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'contentprocessimages' function using a flawed regex-based HTML attribute parser. This makes it possible for...

CVE-2026-80238: Execution with Unnecessary Privileges

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechani...

Linux Distros Unpatched Vulnerability : CVE-2026-53769

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks...

CVE-2026-86242

creationtimestamp| type| source ---|---|--- 2026-09-06 13:00:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3muu2ecn5fk2b 2026-10-05 14:35:33+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-86242.yaml...

CVE-2026-18480: Improper Privilege Management

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...