CVE-2026-21409

Improper authorization vulnerability exists in RICOH Streamline NX 3.5.1 to 24R3. If a man-in-the-middle attack is conducted on the communication between the affected product and its user, and some crafted request is processed by the product, the user's registration information and/or OIDC OpenID...

Dell PowerProtect Data Domain operating system command injection vulnerability

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. The Dell PowerProtect Data Domain suffers from an operating system command injection vulnerability that originates from improper...

CVE-2026-0747

Devolutions Remote Desktop Manager versions 2025.3.24.0 through 2025.3.28.0 on Windows are vulnerable to a sensitive information exposure flaw. The issue resides in the TeamViewer entry dashboard component , where a defective masking feature allows an external observer to view a password on the s...

CVE-2026-21639

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution RCE within the affected product. Affected Products: airMAX AC Version 8.7.20 and earlier airMAX M Version 6.3.22 and earlier airFiber AF60-XG...

CVE-2026-21639

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution RCE within the affected product...

01-numacert (>=1.0.0, <=3.0.0), 12g (>=0.0.15, <=1.0.1) +7551 more potentially affected by CVE-2026-24001 via diff (>=3.0.0, <=3.5.0)

diff NPM version =3.0.0, =1.0.0, =0.0.15, =1.0.4, =5.4.4, =5.4.4, =2.2.1, =1.1.8, =1.0.0, =2.0.0, =0.0.1, =0.1.1, =0.1.0, =1.0.0, =1.8.1 and more Source cves: CVE-2026-24001 Source advisory: SNYK:JS-DIFF-14917201...

CVE-2025-14612

Insecure Temporary File vulnerability in Altera Quartus Prime Pro Installer SFX on Windows allows : Use of Predictable File Names.This issue affects Quartus Prime Pro: from 24.1 through 25.1.1...

wolfSSL Python module vulnerable to Improper Authentication

A vulnerability in the handling of verifymode = CERTREQUIRED in the wolfssl Python package wolfssl-py causes client certificate requirements to not be fully enforced. Because the WOLFSSLVERIFYFAILIFNOPEERCERT flag was not included, the behavior effectively matched CERTOPTIONAL: a peer certificate...

CVE-2026-21639: Buffer Copy without Checking Size of Input

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution RCE within the affected product...

PT-2026-37509

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/buddy component where requested allocation sizes are rounded up using roundup pow of two when DRM BUDDY CONTIGUOUS ALLOCATION is set, or aligned via round up f...

PT-2026-2256

Name of the Vulnerable Software and Affected Versions Mediawiki - Wikibase Extension versions 1.39 through 1.45 Description The Mediawiki - Wikibase Extension is susceptible to a Cross-Site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for the...

Mastodon code issues and vulnerabilities

Mastodon is an open source social networking server based on ActivityPub by Mastodon Open Source. A code issue vulnerability exists in Mastodon versions prior to 4.5.4, prior to 4.4.11, prior to 4.3.17, and prior to 4.2.29, which stems from the lack of an IP address range restriction that could...

CVE-2025-65518

Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The flaw exists in the get_password.php endpoint, where improper handling of malicious payloads allows a crafted request to cause the web interface to reload continuously. An unauthenticated remot...

PT-2026-1848

Name of the Vulnerable Software and Affected Versions Plesk Obsidian versions 8.0.1 through 18.0.73 Description Plesk Obsidian versions 8.0.1 through 18.0.73 are susceptible to a Denial of Service DoS condition. The issue resides in the get password.php API endpoint, where a specifically crafted...

NiceGUI cross-site scripting vulnerability

NiceGUI is an easy-to-use, Python-based UI framework from NiceGUI Open Source. A cross-site scripting vulnerability exists in NiceGUI versions 2.22.0 through 3.4.1, which stems from an insecure implementation of the click event listener and could lead to cross-site scripting attacks...

Asseco InfoMedica security vulnerabilities

Asseco InfoMedica is a comprehensive medical information management system from Asseco Poland. A security vulnerability exists in Asseco InfoMedica version 4.50.1 and prior to version 5.38.0, which stems from insufficient access control granularity and could lead to the acquisition of coded...

PT-2026-2074

Name of the Vulnerable Software and Affected Versions airMAX AC versions 8.7.20 and earlier airMAX M versions 6.3.22 and earlier airFiber AF60-XG version 1.2.2 and earlier airFiber AF60 versions 2.6.7 and earlier Description A malicious actor within Wi-Fi range could exploit a flaw in the airMAX...

CVE-2025-69264

pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the...

@adobe-commerce/elsie (2.1.0-beta.7), @aigelb/chatbot-widget (>=5.0.0, <=8.2.0) +15 more potentially affected by CVE-2026-22028 via preact (>=10.27.0, <=10.27.2)

preact NPM version =10.27.0, =5.0.0, =0.0.1, =0.2.0-canary.7cb2837, =1.2.1, =1.4.1-snapshot-20251113025641, =3.0.263, =0.1.17, =0.1.17, =0.2.22, =1.14.0, =0.0.111, =0.0.122 and more Source cves: CVE-2026-22028 Source advisory: OSV:GHSA-36HM-QXXP-PG3M...

CVE-2019-12472

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks $wgBlockCIDRLimit by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6...