CVE-2026-68469

A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. During Wi-Fi association, if a power-save sleep event occurs while an association command is in flight, the driver can incorrectly set the power-save state. This prevents the necessary sleep confirmation, leading to Wi-Fi scan requests...

Emerson Dixell XWEB-500 - Arbitrary File Write

Emerson Dixell XWEB-500 contains an arbitrary file write caused by unauthenticated access to /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi, letting attackers write any file on the system, exploit requires no authentication. id: CVE-2021-45420 info: name: Emerson...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

CVE-2026-75834

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u UTF-8 modifier, so a single invalid UTF-8 byte anywhere in page content causes pregmatch to return false for...

EUVD-2026-60598

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u UTF-8 modifier, so a single invalid UTF-8 byte anywhere in page content causes pregmatch to return false for...

CVE-2026-75834

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u UTF-8 modifier, so a single invalid UTF-8 byte anywhere in page content causes pregmatch to return false for...

CVE-2026-75834 Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. All XSS detection patterns use the PCRE /u UTF-8 modifier, so a single invalid UTF-8 byte anywhere in page content causes pregmatch to return false for...

CVE-2026-16098 ProSolution WP Client <= 2.0.10 - Unauthenticated Arbitrary File Upload via Content-Disposition Header Filename Override

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.0.10 via the proSolhandleFileUpload function. This is due to missing validation of the attacker-controlled Content-Disposition header filename, which overrides the...

CVE-2026-16098

CVE-2026-16098 affects the ProSolution WP Client plugin for WordPress up to version 2.0.10, where the proSol_handleFileUpload function allows Arbitrary File Upload. The root cause is missing validation of the attacker-controlled Content-Disposition header filename, which can override the allowed ...

CVE-2026-68469 wifi: mwifiex: fix permanently busy scans after multiple roam iterations

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENTSLEEP -...

PT-2026-72181

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix permanently busy scans after multiple roam iterations In order for the firmware to sleep, the driver has to confirm a previously received sleep request. The normal sequence of evets goes like this: EVENT SLEEP ...

CVE-2026-19871

CVE-2026-19871 affects Roskus Prospero Flow CRM prior to version 5.15.9. The root cause is use of hard-coded credentials where the employee save controller falls back to the literal password “changeme” and the onboarding form lacks a password field, enabling unauthenticated remote attackers who k...

PT-2026-72050

A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save doctor of the file /save file.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit is now public and may be used...

CVE-2026-72786 Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

CVE-2026-72786

Craft CMS versions before 5.10.8 are vulnerable to an authentication bypass in the elements/save action. The root cause is an unprotected newPassword field in the User element save flow, which can be exploited by authenticated users with edit users permission to reset any user’s password (includi...

CVE-2026-72786

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

EUVD-2026-57446

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

PT-2026-71228

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the...

CVE-2026-72785 Craft CMS before 5.10.6 Authorization Bypass via structures/move-element

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...