CVE-2026-66696

Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...

EUVD-2026-53965

Unauthenticated Cross Site Scripting XSS in wpDataTables = 7.5.1 versions...

CVE-2026-65551

CVE-2026-65551 concerns the WordPress WordPress Breakdance plugin (versions up to and including 2.6.1) where a Broken Access Control / Missing Authorization flaw exists. The root cause is incorrectly configured access control levels, enabling unauthorized actions due to insufficient restriction o...

CVE-2026-71312

Summary of CVE-2026-71312 : In rclone (pre-1.75.0), the code path in backend/sftp/sftp.go interpolates remote SFTP paths into PowerShell hash commands and uses quoteOrEscapeShellPath that escapes only ASCII apostrophes. This can allow an attacker-controlled filename to terminate the path literal ...

CVE-2026-70430

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

EUVD-2026-53546

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70430

CVE-2026-70430 affects Jenkins up to version 2.575 (non‑LTS) and 2.568.1 LTS. The root cause is that the project naming strategy configuration allowed instantiating arbitrary object types without restricting them, enabling attackers with Overall/Manage permission to instantiate configuration‑rela...

CVE-2026-70609 Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools was not sanitized before use by the DevTools frontend. If an attacker can influence this value,...

CVE-2026-9195 Cross-site scripting in Progress MarkLogic Server Query Console

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...

Stored XSS vulnerability in summary_report

summaryreport 1.15 and earlier does not escape the job name in a JavaScript context in build report pages. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission. As of publication of this advisory, there is no fix...

XXE vulnerability in ivy-report

ivy-report 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller o...

Users with Overall/Manage permission can instantiate any types related to configuration

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration. This allows attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

CVE-2026-46334 OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning

OpenSIPS is a Session Initiation Protocol SIP server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP request with Content-Type: application/sdp and a malformed session-level SDP bandwidth line missing t...

CVE-2026-45705

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...

CVE-2026-45103

OpenSIPS vulnerable to SIP message smuggling via TCP Content-Length overflow. In versions < 3.6.6 and

CVE-2026-47763 pdm: Project-Local State and Config Writes Follow Symlinks

pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite t...

CVE-2026-15830

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...

CVE-2026-17070

Technical details such as affected product/version, root cause, and remediation are not publicly available in the provided documents; monitor for updates.

systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data

A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication IPC API call with spurious data. In older versions v249 and earlier, this can lead to stack overwriting with attacker-controlled content,...