CVE-2026-13392 ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently...

CVE-2026-51371

creationtimestamp| type| source ---|---|--- 2026-07-31 05:02:47+00:00| seen| https://bsky.app/profile/hermes71.bsky.social/post/3mrw6gqxai42n 2026-08-01 04:58:43+00:00| seen| https://bsky.app/profile/pmloik.bsky.social/post/3mryoodbpnu2r...

EUVD-2026-51382

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

SUSE CVE-2026-17666

Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discretionary access control via malicious network traffic. Chromium security severity: High...

SUSE CVE-2026-17716

Use after free in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via malicious network traffic. Chromium security severity: High...

SUSE CVE-2026-17733

Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17774

Insufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic. Chromium security severity: Medium...

EUVD-2026-51329

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...

CVE-2026-17959

An inappropriate implementation flaw was found in the Network component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517607890...

PT-2026-66875

Name of the Vulnerable Software and Affected Versions TP-Link AXE75 V1 affected versions not specified Description An OS command injection flaw exists in the VPN module. This issue occurs due to improper filtering of special characters, allowing an adjacent, authenticated attacker to execute...

PT-2026-66856

Name of the Vulnerable Software and Affected Versions TR1200 version 2.4.15 TR3000 version 2.4.21 WR300 version 2.4.25 WR1200 version 2.4.23 WR1300 version 2.4.22 WR1500 version 2.3.10 WR3000 version 2.4.19 WR3600 version 2.3.16 WR6500 version 2.3.15 Description A command injection issue exists i...

PT-2026-66833

Name of the Vulnerable Software and Affected Versions NTPsec affected versions not specified Description A buffer overflow occurs in the Zyfer refclock component of NTPsec. This issue allows a local attacker to cause a crash of the ntpd process by triggering a buffer copy without checking the siz...

UBUNTU-CVE-2026-16524

A command injection flaw in PCP's linuxsockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh...

PT-2026-66837

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

PT-2026-66768

HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors to be generated...

UBUNTU-CVE-2026-16529

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...

SUSE SLES12 Security Update : prometheus-ha_cluster_exporter (SUSE-SU-2026:3421-1)

The remote SUSE Linux SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:3421-1 advisory. This update for prometheus-haclusterexporter fixes the following issue: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only...

CVE-2026-17660

An insufficient validation of untrusted input flaw was found in the Network component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497428001...

CVE-2026-66360

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This...

CVE-2026-63362

An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet...