CVE-2026-76487 Cisco Unified Communications Manager Improper Access Control Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...

CVE-2026-76487

A vulnerability exists in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) . The flaw stems from improper input validation for specific HTTP requests, which could allow an unauthenticated, remote attacker to per...

CVE-2026-113798

The Electron framework is vulnerable to an Origin Validation Error (CWE-346) in versions prior to 42.11.9 , 43.7.6 , 44.5.0 , and 45.0.0-alpha.13 . The root cause is that pointerLock permission requests from certain cross-origin iframes incorrectly cause session.setPermissionRequestHandler() to r...

InletGuard

InletGuard InletGuard is a native PHP extension like curl...

CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

CVE-2026-113796 Electron: SameSite cookie restrictions are not applied to windows opened from links

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

CVE-2026-113796

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as application-initiated navigations instead of preserving the page...

CVE-2026-113796

The Electron framework (prior to versions 42.11.3 , 43.7.0 , 44.3.0 , and 45.0.0-alpha.6 ) fails to correctly apply SameSite cookie restrictions when opening new windows via links. The framework incorrectly treats these as application-initiated navigations rather than preserving the initiating pa...

Xpro Elementor Addons cross-site request forgery vulnerability

Xpro Elementor Addons versions 1.7.10 and earlier contain a cross-site request forgery vulnerability, which stems from susceptibility to such attacks...

World Wide Broadcast Network AVideo server request forgery vulnerability

Versions prior to AVideo 29.4.0 of the World Wide Broadcast Network contain a server-side request forgery vulnerability. This vulnerability arises because getheaders in getHeaderContentTypeFromURL fails to revalidate the target URL via isSSRFSafeURL after a redirect, resulting in blind server-sid...

Roundcube Webmail Project Roundcube Webmail server request forgery vulnerability

The Roundcube Webmail project contains a server-side request forgery vulnerability in versions prior to 1.6.14 and 1.7.0. This vulnerability stems from an omission in the network blacklist used by rcubeutils::islocalurl, which fails to include the NAT64 prefixes 64:ff9b::/96, 64:ff9b:1::/48, and...

KNIME Business Hub cross-site request forgery vulnerability

Versions prior to KNIME Business Hub 1.19.0 contain a cross-site request forgery vulnerability. This flaw stems from inadequate protection against such attacks, potentially allowing authenticated attackers to execute cross-site request forgery attacks via passive user interactions, thereby alteri...

Netmaker authorization issue vulnerability

Netmaker versions 1.7.0 and earlier contain an authorization vulnerability. This vulnerability stems from an authorization bypass in the updateExtClient handler. An attacker with network-level client privileges can send a PUT request to /api/extclients/network/clientid, thereby replacing the publ...

Drupal Project Browser cross-site request forgery vulnerability

Drupal Project Browser versions prior to 0.0.0 and 2.0.3, as well as versions prior to 2.1.0 and 2.1.5, contain a cross-site request forgery vulnerability. This vulnerability stems from the system’s susceptibility to cross-site request forgery attacks...

Drupal Tawk.to - Live cross-site request forgery vulnerability

Drupal Tawk.to – Versions 0.0.0 through 3.0.4 contain a cross-site request forgery vulnerability, which stems from susceptibility to such attacks...

Drupal Webform authorization issue vulnerability

Versions prior to Drupal Webform 6.2.12 and 6.3.1 contain an authorization issue vulnerability stemming from improper authorization checks, which may lead to server-side request forgery...

Cisco Unified Communications Manager Improper Access Control Vulnerability

A vulnerability in Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct access control bypass attacks on an affected device. This vulnerability is due to improp...

Exploit for CVE-2026-109618

php2shell-check Check in about a minute whether a server is a...

php: OOM bailout during request parsing leads to memory corruption and RCE

A flaw was found in PHP's memory limit handling during request parsing. PHP records certain state as ready for use before all required memory allocations complete. If an allocation fails due to memory exhaustion, the incomplete state is not rolled back. Subsequent cleanup operations treat the...

USN-8948-2 php5, php7.0, php7.2, php7.4 vulnerabilities

USN-8948-1 fixed vulnerabilities in Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. This provides the corrosponding updates in Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that PHP incorrectly handle...