PT-2026-83518

Name of the Vulnerable Software and Affected Versions ash sqlite versions 0.1.2-rc.0 through 0.2.17 Description Improper neutralization of special elements in data query logic allows an attacker to traverse into nested JSON data that the application did not intend to expose, potentially disclosin...

EUVD-2026-68120

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks...

CVE-2026-82463 pac4j-core before 6.5.6 Authorization Bypass via Reversed Profile Type Check

pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks...

EUVD-2026-66296

A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...

GHSA-V358-WF77-39XV klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Summary In processPercentageRoyaltiesTransfer the royalty pool is collected from the sender by SubFromBalance that is ordered after the split loop and after if royaltiesToPay royaltiesToPay, so a split entry of exactly 100% PercentTransferPercentage = 10000 is a valid config: it drives...

klever-go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Summary In processPercentageRoyaltiesTransfer the royalty pool is collected from the sender by SubFromBalance that is ordered after the split loop and after if royaltiesToPay royaltiesToPay, so a split entry of exactly 100% PercentTransferPercentage = 10000 is a valid config: it drives...

CVE-2026-55763 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay royaltiesToPay, so a valid PercentTransferPercentage = 10000 split...

CVE-2026-55763

CVE-2026-55763 affects Klever-Go (the Go implementation of the Klever blockchain), prior to version 1.7.19 . In processPercentageRoyaltiesTransfer (core/kapp/accounts/accounts.go), the sender's royalty debit via SubFromBalance is ordered after the split loop and after the royaltiesToPay

CVE-2026-54754

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...

CVE-2026-54754

Klever-Go (the Go node for the Klever blockchain) has a time-of-check/time-of-use flaw in marketplace settlement (core/kapp/market/market.go). The referral percentage is snapshotted at listing, but the royalty percentage is read live at purchase. An asset owner can raise the royalty via UpdateRoy...

EUVD-2026-67824

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, marketplace settlement in core/kapp/market/market.go reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a...

CVE-2026-82123

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Tangible Loops & Logic...

CVE-2026-80665

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-82123 WordPress Loops & Logic - Reflected XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Tangible Loops & Logic...

EUVD-2026-67459

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Tangible Loops & Logic...

CVE-2026-82123

CVE-2026-82123 is a reflected cross-site scripting (XSS) vulnerability in the Tangible Loops & Logic WordPress plugin, caused by improper neutralization of input during web page generation. Per the assigned CVSS 3.1 score of 6.5 (Medium) , the attack vector is network-based with low complexity, r...

EUVD-2026-67541

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-80665 KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Inject SEA if kvmtranslatevncr can't resolve PFN kvmhandlevncrabort assumes that s1walkresult conveys an abort when kvmtranslatevncr returns -EFAULT. This is not always the case as it's possible to encounter 'late...

CVE-2026-78618

A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by sending a specially crafted request...

CVE-2026-71187

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device...