AEM Forms Server-Side Validation Exploitation

The vulnerability of the corporate platform for creating, managing, and processing Adobe Experience Manager AEM Forms on JEE is related to insufficient validation of requests at the server side. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

AEM Platform Security Bypass

The vulnerability of the corporate platform for creating, managing, and processing electronic forms, documents, and business processes within Adobe Experience Manager AEM Forms on JEE is related to the exploitation of cross-site requests. Exploiting this vulnerability could allow a malicious acto...

CVE-2026-15999: Improper Validation of Integrity Check Value

Improper validation of integrity check value in the AES-CCM implementation CcmParameters and CcmBlockCipher in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via an AlgorithmIdentifier whose CCMParameters declar...

CVE-2026-86345 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

CVE-2026-86345 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

CVE-2026-86345

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

CVE-2026-34493

On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO FS32: before 3.3b63...

CVE-2026-34494

On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects Neo Series MVP2: before 3.3b63...

CVE-2026-34494

A vulnerability in the On-Chip Debug Interface of Johnson Controls Neo Series MVP2 (versions before 3.3b63 ) allows an attacker to Collect Data from Common Resource Locations . The issue is associated with CWE-1191 (On-Chip Debug and Test Interface With Improper Access Control). The CVSS 4.0 scor...

CVE-2026-34494

On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects Neo Series MVP2: before 3.3b63...

CVE-2026-34494

On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue affects Neo Series MVP2: before 3.3b63...

CVE-2026-34493

A vulnerability in the On-Chip Debug Interface of Johnson Controls EasyIO FS32 (versions before 3.3b63 ) allows an attacker to Collect Data from Common Resource Locations . This issue is associated with CWE-1191 , involving an On-Chip Debug and Test Interface with Improper Access Control . The vu...

CVE-2026-34493

On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO FS32: before 3.3b63...

CVE-2026-34493

On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affects EasyIO FS32: before 3.3b63...

GO-2026-6585 Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go

Klever-Go: Elasticsearch bulk / painless injection via on-chain account name - explorer/indexer data forgery in github.com/klever-io/klever-go...

cklauth (>=0.1.0, <=0.3.0), django-models-logging (1.0.0) +9 more potentially affected by CVE-2026-15307 via django (2.0.0)

django PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cklauth =0.1.0, =0.1.0, =1.7.0, =1.7.2 - djangotheming 0.1.0 - fastaudiovisal 0.0.1 - fastaudiovisual 0.0.1 - ip2l 8.5.1 - prediction 0.0.3 -...

CVE-2026-96813

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...

CLEANSTART-2024-UY78524 Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89

Security vulnerability affects the chromium package. Insufficient data validation in Chrome on iOS in Google Chrome on iOS prior to 89...

CLEANSTART-2024-XF14437 Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92

Security vulnerability affects the chromium package. Insufficient policy enforcement in image handling in iOS in Google Chrome on iOS prior to 92...

CVE-2026-96813 Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields

The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields in all versions up to, and including, 1.15.47 due to insufficient input sanitization and output escaping. This mak...