CVE-2026-73600

Dell PowerProtect Data Manager versions 20.2.0.0 and below contain a stack buffer overflow in the file-level restore agent . According to the description, a high-privileged remote attacker could exploit this to achieve information disclosure , though the assigned CVSS 3.1 vector (7.8 HIGH ) score...

CVE-2026-9853

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...

CVE-2026-14666

A flaw in PostgreSQL allows users to bypass row-level security RLS due to incomplete tracking of user role and database ownership changes. Active sessions may continue using cached, outdated security policies, enabling unauthorized read or write access to data. Exploitation requires the attacker ...

AlcaTRAz - Anchored Tree-Rule Defense against Jailbreaks

Large language models LLMs are vulnerable to jailbreak attacks that bypass safety alignment through carefully crafted prompts. Many existing defenses require access to model weights or internals, making them difficult to apply to black-box deployments. We propose AlcaTRAz Anchored Tree-Rule defen...

CVE-2026-73600: Stack-based Buffer Overflow

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-84962: Improper Neutralization of CRLF Sequences

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption...

CVE-2026-81282: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...

CVE-2026-2573: Improper Neutralization of Input During Web Page Generation

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-81281: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

PT-2026-84921

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-82023: Incorrect Authorization

LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with the Instructor role to add answers to quiz questions owned by other instructors by exploiting a missing ownership check on the question answer insert path...

CVE-2026-84779: Missing Authorization

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...

PT-2026-85214

Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization CWE-862 in Kibana can lead to unauthorized modification of data via Privilege Abuse CAPEC-122. An authenticated user holding Security read-level access in a single Kibana space could trigger Entit...

CVE-2026-25718

creationtimestamp| type| source ---|---|--- 2026-09-02 23:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mul35bvf6v2o...

CVE-2026-84887

creationtimestamp| type| source ---|---|--- 2026-09-02 23:17:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gw7vxsp5ybbou...

CVE-2026-53671

creationtimestamp| type| source ---|---|--- 2026-09-02 20:07:56+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mukqfoyrwn2p 2026-09-02 20:50:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3muksr3u7jm2v...

CVE-2026-63311

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:05+00:00| published-proof-of-concept| https://github.com/nltk/nltk/security/advisories/GHSA-3gqm-fcw5-w839 2026-09-02 21:32:05+00:00| seen| https://gist.github.com/alon710/d2b8511d121d9c8c1d87b14251d4a3da...

WordPress GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777 in WordPress Plugin GutenKit versions = 2.4.4...

CVE-2026-10821

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

fastify vulnerable to schema validation bypass via root primitive coercion mismatch

Impact fastify before 5.12.1, when a route uses a root-level primitive body schema for example an integer with a minimum and maximum and the default type coercion, validates the coerced value but exposes the original, uncoerced value to the route handler. For example, a JSON body "10" is coerced ...