CVE-2026-109340 SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permissio...

CVE-2026-109245 FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request

FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdphttprequest in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD...

WordPress click5 CRM add-on to Contact Form 7 plugin <= 1.0.4 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to Contact Form 7 versions = 1.0.4...

WordPress click5 CRM add-on to Gravity Forms plugin <= 1.0.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to Gravity Forms versions = 1.0.3...

WordPress click5 CRM add-on to WPForms plugin <= 1.0.3 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to WPForms versions = 1.0.3...

WordPress click5 CRM add-on to Ninja Forms plugin <= 1.0.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin click5 CRM add-on to Ninja Forms versions = 1.0.1...

WordPress click5 CRM add-on to Contact Form 7 plugin <= 1.0.4 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin click5 CRM add-on to Contact Form 7 versions = 1.0.4...

WordPress click5 CRM add-on to WPForms plugin <= 1.0.3 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin click5 CRM add-on to WPForms versions = 1.0.3...

WordPress click5 CRM add-on to Ninja Forms plugin <= 1.0.1 - Unauthenticated Arbitrary Options Update vulnerability

Unauthenticated Arbitrary Options Update vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin click5 CRM add-on to Ninja Forms versions = 1.0.1...

WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by AndrewN in WordPress Plugin Auction Nudge – Your eBay on Your Site versions = 8.4.0...

PT-2026-111117

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process...

PT-2026-111103

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

PT-2026-111105

IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API...

PT-2026-111100

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A remote authenticated attacker can execute arbitrary commands due to improper neutralization of special elements used in an OS command. This issue occurs when the system fails to...

PT-2026-111101

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A path traversal issue allows a remote authenticated attacker to cause a denial of service. Path traversal is a flaw that allows an attacker to access files and directories that a...

PT-2026-110757

Name of the Vulnerable Software and Affected Versions SurrealDB versions 3.1.0 through 3.2.x Description An authorization bypass allows authenticated users to delete protected graph edges. This occurs when a user with delete permissions on a referenced table triggers a REFERENCE ON DELETE CASCADE...

CVE-2026-109340: Missing Authorization

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permissio...

CVE-2026-82096: Improper Neutralization of Special Elements used in an OS Command

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

CVE-2026-82101: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...

CT0: Cybersecurity Transformer

General-purpose frontier models are large, expensive to run, and increasingly reluctant to engage with authorised defensive- and offensive-security work. We ask the opposite question: how small can a cybersecurity-specialist transformer be while remaining genuinely useful to a security...