EUVD-2026-51716

The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of...

EUVD-2026-51654

An issue in the parseGoosePayload function /goose/goosereceiver.c of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame...

CVE-2026-54768 WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an unauthenticated caller distinguish existing author-class accounts through the sendPasswordResetEmail mutation and obtain public profile fields. This...

WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

CVE-2026-52134

An issue in the parseGoosePayload function /goose/goosereceiver.c of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame...

CVE-2026-68771

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to execute arbitrary Python code by uploading a crafted pickle file and triggering its deserialization. Attackers can upload a malicious shard.pkl file via...

SUSE CVE-2026-15722

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...

CVE-2026-15722

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...

UBUNTU-CVE-2026-15722

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...

CVE-2026-14539

The CVE affects Google mcp-toolbox versions up to 1.4.0, where the HTTP /mcp endpoint reads request bodies into memory using an unrestricted buffer (io.ReadAll) without limits. This unbounded buffering enables an unauthenticated attacker to cause a DoS by exhausting host memory, ultimately leadin...

CVE-2026-14539 Denial of Service via Unrestricted Payload Buffering in MCP Toolbox

An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service DoS. The /mcp endpoint handler reads incoming payloads directly into system memory using a...

CVE-2026-52134

CVE-2026-52134 affects libiec61850 v1.6, in the parseGoosePayload() function (/goose/goose_receiver.c). The issue allows bypassing authentication via captured GOOSE frames due to inadequate handling of replayed/stale frames in the GOOSE subscriber path, potentially delivering older state data to ...

PT-2026-66871

Name of the Vulnerable Software and Affected Versions WPGraphQL versions 2.0.0 through 2.15.0 Description An unauthenticated caller can distinguish existing author-class accounts and obtain public profile fields through the sendPasswordResetEmail mutation. While the mutation is designed to preven...

PT-2026-66864

Name of the Vulnerable Software and Affected Versions libiec61850 version 1.6 Description An issue exists in the parseGoosePayload function located in /goose/goose receiver.c that allows attackers to bypass authentication by using a captured GOOSE frame. GOOSE Generic Object Oriented Substation...

CVE-2026-52134

An issue in the parseGoosePayload function /goose/goosereceiver.c of libiec61850 v1.6 allows attackers to bypass authentication via a captured GOOSE frame...

CVE-2026-68503

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payloadschema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachabl...

SUSE CVE-2026-45713

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...

CVE-2026-57859

e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...

EUVD-2026-51123

e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...

CVE-2026-57859

Summary of CVE-2026-57859 : In e107 prior to version 2.3.8, a code execution vulnerability exists in the e_array deserialization handler. The e_array::unserialize() function only checks for the prefix 'array' before passing the stored value to eval(), allowing an attacker with out-of-band databas...