CVE-2026-75332: Server-Side Request Forgery (SSRF)

Zyplayer-Doc =1.0.0 is vulnerable to Server-Side Request Forgery SSRF via WikiPageWebService.download...

CVE-2026-75325: Improper Authentication

DWSurvey v6.14.0 is is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/' parameters...

CVE-2026-58108: Improper Access Control

The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...

CVE-2026-76148: Improper Control of Generation of Code

CorvusSKK contains a code injection vulnerability, which may lead to arbitrary code execution on the affected product...

CVE-2026-26449: NULL Pointer Dereference

In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference or access to invalid memory while processing the frame, causing the process to crash...

CVE-2026-12587: Use of Hard-coded Credentials

The vulnerability allows the unauthorised generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badgenumber' parameter as the HMAC private key, the value of which remains static and is accessible via the API usin...

CVE-2026-15366: Improper Isolation or Compartmentalization

A control logic defect in a specific built-in webpage of Kids Mode allows users to view local gallery photos directly within the page...

CVE-2026-51106: Uncontrolled Resource Consumption

An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component...

CVE-2026-68861: Improper Neutralization of Special Elements used in an OS Command

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-19538: Authentication Bypass by Spoofing

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open...

CVE-2026-80521: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: afunix: Unlink sccentry in unixdeledge. Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1 Create two SCCs: X -. A B ^--' 2 Run the following concurrently: 2-1 send sk-B to sk-B from sk-X 2-...

CVE-2026-59682: External Control of File Name or Path

Arbitrary file overwrite via SAVEPROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3...

nuclei-templates v10.4.8

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the nuclei scanner which powers the actual scanning engine. This...

overflowscanner

Security Scanners A set of lightweight, dependency-free def...

CVE-2026-77138: Deserialization of Untrusted Data

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server...

CVE-2026-63586: Improper Neutralization of Special Elements used in an OS Command

The web-based management interface uses a modified uhttpd server with CGI shell scripts. The HTTP Basic Authentication username, taken directly from the Authorization header without sanitization, is inserted into a shell command string executed via the system function. By submitting a specially...

WPProbe Plugin Enumeration Tool 0.12.10

A fast WordPress plugin and theme scanner that detects installed plugins via REST API enumeration and themes from HTML discovery, then maps them to known vulnerabilities. Over 5,000 plugins detectable without brute-force, thousands more with it...

CVE-2026-69104: Missing Authorization

An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue...

CVE-2026-77135: Authorization Bypass Through User-Controlled Key

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying ...

CVE-2026-76189: Integer Underflow (Wrap or Wraparound)

CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...