Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Improper neutralization of parameter/argument delimiters in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

WordPress Events Manager plugin <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter vulnerability

Reflected Cross-Site Scripting via 'headerformat' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Events Manager versions = 7.4.0.1...

WordPress All-in-One WP Migration Unlimited Extension plugin <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'ai1wmbackupspath' Parameter vulnerability discovered by Rafie Muhammad - Awesome Motive, Inc. in WordPress Plugin All-in-One WP Migration Unlimited Extension versions = 2.84...

Exploit for Eval Injection in Langflow

CVE-2026-33017 - Langflow Unauthenticated RCE Exploit 📋 Ov...

WordPress ProSolution WP Client plugin < 2.0.11 - Reflected XSS via 'page' Parameter vulnerability

Reflected XSS via 'page' Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin ProSolution WP Client versions 2.0.11...

WordPress Welcart e-Commerce plugin < 2.12.1 - Session Fixation via uscesid Parameter vulnerability

Session Fixation via uscesid Parameter vulnerability discovered by bRpsd in WordPress Plugin Welcart e-Commerce versions 2.12.1...

Malicious code in cacao1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 403a43aab3b982d17c5c01d7df45149d796e7185f4137bf4a92675351a1b50e8 The package has no advertised functionality empty description, self-referential dependency on its own name at ^9.9.9. Its package.json declares both...

MAL-2026-14591 Malicious code in cacao1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 403a43aab3b982d17c5c01d7df45149d796e7185f4137bf4a92675351a1b50e8 The package has no advertised functionality empty description, self-referential dependency on its own name at ^9.9.9. Its package.json declares both...

metabase-sql-poc

CVE-2026-72898 — Metabase Unauthenticated SQL Injection PoC...

CVE-2026-6128

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...

Security update for python36

This update for python36 fixes the following issues: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF bytes bsc1261969...

SUSE-SU-2026:3855-1 Security update for python36

This update for python36 fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1502: HTTP client proxy tunnel headers not validated for CR/LF bytes bsc1261969. -...

SUSE-SU-2026:23364-1 Security update for c-ares

This update for c-ares fixes the following issues: Update to c-ares 1.34.8. - CVE-2025-31498: use-after-free in readanswers when processanswer may re-enqueue a query bsc1240955. - CVE-2025-62408: use-after-free due to connection being cleaned up after error bsc1254738. - CVE-2026-33630: remotely...

nacos-authscope

Nacos 3.x: Authentication Scope Mismatch Unauthorized Self-Bu...

Exploit for OS Command Injection in Synacor Zimbra_Collaboration_Suite

Wazuh Rules CVE-2026-73570 Zimbra OS Command Injection Dete...

Security Bulletin: Security vulnerabilities have been identified in Java Jackson Databind library shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in Jackson Databind shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...

Security Bulletin: Security vulnerabilities have been identified in Jackson Databind shipped with IBM Guardium Cryptography Manager (GCM)

Summary Security vulnerabilities identified in Jackson Databind shipped with IBM Guardium Cryptography Manager GCM have been addressed Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data...

Exploit for CVE-2025-10952

CVE-2025-10952 — ml-logger streamhandler Arbitrary File Rea...

CVE-2026-80717

In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctpverifyparam accepts a header-only parameter...

AZL-98190 CVE-2026-80717 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: validate Adaptation Indication parameter length The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctpverifyparam accepts a header-only parameter...