CVE-2026-7009

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine...

CVE-2026-7009 OCSP stapling bypass with Apple SecTrust

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it fails to detect OCSP problems and instead wrongly consider the response as fine...

CVE-2026-29168

A flaw was found in the modmd module of httpd. When processing OCSP Online Certificate Status Protocol responses from a malicious or compromised OCSP responder, the module fails to enforce proper size limits on the incoming data. This issue leads to memory exhaustion and a denial of service...

Description of the security update for Office Online Server: May 12, 2026 (KB5002871)

None None...

CVE-2026-6708 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' Parameter

The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permissioncallback of 'returntrue', which bypasses all...

Microsoft Excel 资源管理错误漏洞

Microsoft Excel is a spreadsheet software within the Office suite developed by Microsoft Corporation. There is a resource management vulnerability in Microsoft Excel. Attackers can exploit this vulnerability to execute code remotely. The following products and versions are affected: Office Online...

Microsoft Excel 安全漏洞

Microsoft Excel is a spreadsheet software within the Office suite developed by Microsoft Corporation. There are security vulnerabilities in Microsoft Excel. Attackers can exploit these vulnerabilities to execute code remotely. The following products and versions are affected: Office Online Server...

WordPress plugin HEL Online Classroom: AI-powered Online Classrooms 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

Security Updates for Microsoft Office Online Server (May 2026)

The Microsoft Office Online Server or Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. CVE-2026-40359 -...

Microsoft Excel 缓冲区错误漏洞

Microsoft Excel is a spreadsheet software within the Office suite developed by Microsoft Corporation. There is a buffer error vulnerability in Microsoft Excel. Attackers can exploit this vulnerability to obtain sensitive information. The following products and versions are affected: Office Online...

PT-2026-39962

The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permission callback of ' return true', which bypasses...

CVE-2026-8220

A vulnerability was detected in Devs Palace ERP Online up to 4.0.0. This affects an unknown function of the file /inventory/customer-save. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted ear...

WordPress HEL Online Classroom: AI-powered Online Classrooms plugin <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Classroom Deletion vulnerability discovered by Legion Hunter in WordPress Plugin HEL Online Classroom: AI-powered Online Classrooms versions = 1.0.3...

EUVD-2026-29011

A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. This vulnerability affects unknown code of the file /accounts/mr-save. Such manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. T...

CVE-2026-8262 Devs Palace ERP Online chart-save cross site scripting

A vulnerability was identified in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /accounts/chart-save. Such manipulation leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was...

CVE-2026-8262

CVE-2026-8262 affects Devs Palace ERP Online up to version 4.0.0. The issue involves manipulation of the file/function /accounts/chart-save that leads to cross-site scripting (XSS). The vulnerability is exploitable remotely over the network; the exploit is publicly available. Affected component: ...

EUVD-2026-29009

A security flaw has been discovered in Devs Palace ERP Online up to 4.0.0. Affected by this issue is some unknown functionality of the file /inventory/salessave. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-8256 Devs Palace ERP Online mr-save cross site scripting

A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. This vulnerability affects unknown code of the file /accounts/mr-save. Such manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. T...

EUVD-2026-29010

A weakness has been identified in Devs Palace ERP Online up to 4.0.0. This affects an unknown part of the file /inventory/addnewcustomer. This manipulation causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for...

CVE-2026-8255

CVE-2026-8255 affects Devs Palace ERP Online up to version 4.0.0, impacting an unknown portion of the file /inventory/add_new_customer. The vulnerability enables cross-site scripting (XSS) through a manipulation of that endpoint, with remote attack capability. The exploitation possibility is supp...