CVE-2026-73041 SiYuan before v3.7.4 Remote Code Execution via PDF Annotations

SiYuan versions before v3.7.4 fail to validate or escape annotation fields written to disk by the setFileAnnotation endpoint. Attackers can inject malicious markup into annotation fields that execute as script in the PDF renderer with full Node.js access when a user opens an annotated PDF...

CVE-2026-55153 vulnerabilities

Vulnerabilities for packages: hono, airbyte-platform, debezium, airbyte-server-fips, airbyte-platform-fips...

MINI-23Q5-H2M8-M4P9

Bulletin has no description...

MINI-CV28-GHF4-WGHC

Bulletin has no description...

MINI-GVMQ-59PG-WR35

Bulletin has no description...

MINI-8XJM-PWQW-GPWM

Bulletin has no description...

MINI-Q568-XRJ7-XVXH

Bulletin has no description...

CVE-2026-18855

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

Exploit for CVE-2024-999999

CVE-2024-999999 PoC Proof-of-concept for CVE-2024-999999 hea...

EUVD-2026-59784

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

CVE-2026-18855

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the lldeletelinkfields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...

MAL-2026-14068 Malicious code in depcruise-wrap-stream-in-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...

Security Bulletin: This Power System update is being released to address CVE-2026-16661

Summary Power Systems Firmware is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over th...

Security Bulletin: This Power System update is being released to address CVE-2026-16832

Summary Power Systems Firmware is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity...

Exploit for CVE-2026-64638

No d...

MINI-RVMQ-XXFR-X4RM

Bulletin has no description...

Exploit for Code Injection in Samba

SambaCry CVE-2017-7494 Exploit CVE-2017-7494/SambaCry allows...

CVE-2026-74507 Bluetooth: HIDP: validate numbered report payloads

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidpgetrawreport waits for a numbered report, hidpprocessdata compares the expected report number with skb-data0. A connected HIDP peer can reply with only a DATA transactio...

CVE-2026-18438

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetchremotefile function. This is due to a filename validation/destination mismatch ...

EUVD-2026-59601

The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetchremotefile function. This is due to a filename validation/destination mismatch ...