CVE-2026-85484

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element...

CVE-2026-52486

An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module...

CVE-2026-85485

The HTML::FormHandler Perl module in versions before 0.410002 is vulnerable to Cross-Site Scripting (XSS) . The root cause is the failure to properly escape certain error messages when rendered into HTML. Specifically, the Table form layout and the Bootstrap 2 and 3 wrappers splice error strings ...

Malicious code in punypump (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56cc14096d20f679823bf15af9f44dff039e01f23d2082eba8020200d04a7f The package presents itself as a console shim index.js is a verbatim copy of console-browserify with description 'Emulate console for all the...

Exploit for Type Confusion in Google Chrome

CVE-2026-85046 Saw the other POC of this and I thought to mys...

CVE-2026-69720

Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...

CVE-2026-69508

Stack-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally...

CVE-2026-78464

CVE-2026-78464 is a time-of-check time-of-use (TOCTOU) race condition in the Windows MIDI Service Module that allows an authorized local attacker with low privileges to escalate privileges. The vulnerability requires local access with high attack complexity and no user interaction, resulting in a...

CVE-2026-69720

CVE-2026-69720 is a heap-based buffer overflow in the Windows MIDI Service Module that allows a locally authenticated attacker with low privileges to escalate privileges. The vulnerability requires local access , low complexity , and no user interaction , with high impact across confidentiality, ...

CVE-2026-69508

A stack-based buffer overflow in the Windows MIDI Service Module allows a locally authenticated attacker with low privileges to escalate privileges, achieving high impact across confidentiality, integrity, and availability (CVSS 3.1: 7.8 HIGH ). No user interaction is required. The vulnerability ...

EUVD-2026-65440

NLTK: Allowlisted pickle loaders still permit code execution in current source...

NLTK: Allowlisted pickle loaders still permit code execution in current source

Summary The current source tree still allows arbitrary code execution during supposedly safer allowlisted pickle loading. The allowlist trusts whole module namespaces instead of exact safe globals, so crafted pickles can invoke dangerous in-namespace callables through pickle REDUCE. Details -...

CVE-2026-79572

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

CVE-2026-16025

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16037

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16037

CVE-2026-16037 is an observable timing discrepancy in the PayTR Virtual Pos iFrame API (v9x) WHMCS Module (versions v9.0.0 through before v9.0.3) that allows a callback authentication bypass via timing attack , enabling black box reverse engineering . The CNA-assigned CVSS 3.1 score is 7.5 (HIGH)...

CVE-2026-16037 Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16037 Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...

EUVD-2026-72853

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API v9x WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API v9x WHMCS Module: from v9.0.0 before v9.0.3...

CVE-2026-16025 Improper Payment Validation in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Input Data Manipulation. This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3...