CVE-2026-35163 OctoPrint: XSS in Suppressed Command Notifications

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popups use PNotify rendering for printer-controlled payload.command and payload.message values in src/octoprint/static/js/app/viewmodels/terminal.js without HTML...

CVE-2026-77264

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 4.8.6. This is due to the handleemailotpreturn function returning the secret magic login token in the response t...

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution

A now-patched security flaw impacting Zimbra Collaboration ZCS has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team CERT Polska. The vulnerability in question is CVE-2026-73570 CVSS score: 8.9, which refers to a case of command injection that ca...

CVE-2026-76347

Splunk Secure Gateway's Report Notifications REST API fails to validate notification path values before sending system-authenticated internal requests, allowing non-admin users to trigger SSRF, alter Search Head Cluster state, and cause denial of service. Affected versions: Splunk Enterprise belo...

VulnCheck KEV: CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...

CVE-2026-74356 vhost: fix vhost_get_avail_idx for a non empty ring

In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhostgetavailidx for a non empty ring vhostgetavailidx is supposed to report whether it has updated vq-availidx. Instead, it returns whether all entries have been consumed, which is usually the same. But not always - i...

CVE-2026-74356 vhost: fix vhost_get_avail_idx for a non empty ring

In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhostgetavailidx for a non empty ring vhostgetavailidx is supposed to report whether it has updated vq-availidx. Instead, it returns whether all entries have been consumed, which is usually the same. But not always - i...

PT-2026-72792

In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhost get avail idx for a non empty ring vhost get avail idx is supposed to report whether it has updated vq-avail idx. Instead, it returns whether all entries have been consumed, which is usually the same. But not...

CVE-2026-66424

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424 WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-66424

CVE-2026-66424 affects the WordPress plugin SMS Alert Order Notifications (versions

CVE-2026-66424

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

EUVD-2026-57860

Unauthenticated Privilege Escalation in SMS Alert Order Notifications = 3.9.7 versions...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

CVE-2026-62690

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

EUVD-2026-56344

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...

CVE-2026-62690 Windows Push Notifications Elevation of Privilege Vulnerability

...

CVE-2026-62690

CVE-2026-62690 concerns Windows Push Notifications. The issue is a race condition caused by concurrent execution using a shared resource with improper synchronization, allowing an authorized attacker to elevate privileges locally. The available documents do not specify the affected product versio...

CVE-2026-62690 Windows Push Notifications Elevation of Privilege Vulnerability

...

Windows Push Notifications Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Push Notifications allows an authorized attacker to elevate privileges locally...