CVE-2026-76710: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...

CVE-2026-76711: Improper Input Validation

A vulnerability exists in an Analytics and Location Engine ALE component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful...

CVE-2026-76712: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability exists in the Analytics and Location Engine ALE that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications...

CVE-2026-76709: Improper Access Control

A vulnerability exists in the internal administrative component of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting i...

CVE-2026-76708: Use of Hard-coded Credentials

A vulnerability exists in the Analytics and Location Engine ALE where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in usi...

CVE-2026-75432: Untrusted Pointer Dereference

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent, and Scanner::PushIndentTo components...

CVE-2026-77619: Improper Handling of Length Parameter Inconsistency

Vector is a high-performance observability data pipeline. From 0.15.0 until 0.57.0, the logstash source reads a 32-bit compressed-frame length from the network and uses it to size an in-memory buffer without an upper bound. An unauthenticated remote peer that can reach the default 0.0.0.0:5044...

CVE-2026-68956

Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of sshconnection:handlemsg/4 checks only...

CVE-2026-37603

The pH7Builder (pH7 Social Dating CMS) software, versions through 19.2.0 , is vulnerable to an improper restriction of excessive authentication attempts in the administration login. The root cause is that the CAPTCHA escalation flag is stored in the PHP session as captcha_admin_enabled, and the C...

CVE-2026-75432

A vulnerability exists in yaml-cpp version 0.9.0 where a remote attacker can obtain sensitive information . The flaw is located within the src/scanner.cpp file, specifically affecting the Scanner::PopIndent() and Scanner::PushIndentTo() components. The issue is caused by a flaw in how the scanner...

EUVD-2026-84854

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent, and Scanner::PushIndentTo components...

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-95660: Improper Neutralization of Special Elements used in an OS Command

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched...

CVE-2026-95657: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in dgtlmoon Changedetection.io up to 0.55.8. This issue affects the function setCurrentSelectedText of the file changedetectionio/static/js/visual-selector.js of the component Visual Selector. Executing a manipulation of the argument s can lead to cross site...

CVE-2026-95656: Server-Side Request Forgery (SSRF)

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function addwatchuisnapshot of the file changedetectionio/blueprint/addwatchui/init.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-43643: Missing Authorization

Softaculous Virtualizor before 3.2.9 Patch 9 and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticated remote attackers to modify any tenant's account balance by supplying crafted act and frombillingmodule parameters to the admin panel...

CVE-2026-95500: Unrestricted Upload of File with Dangerous Type

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function fileputcontents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to b...

CVE-2026-94570: Improper Validation of Specified Type of Input

SGLang contains a DoS vulnerability caused by missing input validation for AUXDATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial o...

CVE-2026-95499: Unrestricted Upload of File with Dangerous Type

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function moveuploadedfile of the file filemanager.php. Executing a manipulation of the argument files can lead to unrestricted upload. The attack can be executed remotely. The vendor was...

CVE-2026-95396: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalController.java of the component Public Search Handlers. The manipulation of the argument Search leads to cross site scripting. The attack can b...