CVE-2026-5116: Improper Neutralization of Input During Web Page Generation

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

CVE-2026-20303: Improper Input Validation

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

CVE-2026-63457: Uncontrolled Resource Consumption

A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 iLO 6 prior to v1.78...

CVE-2026-71280: Server-Side Request Forgery (SSRF)

go-shiori's DownloadBookmark internal/core/download.go fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks...

CVE-2026-71204: Improper Access Control

changedetection.io's /settings save handler builds an update dict from form.data'application' and blind-merges it into the stored application settings via .update...

CVE-2026-55998: Observable Response Discrepancy

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-71226: Use After Free

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...

CVE-2026-67864: Uncontrolled Resource Consumption

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component...

CVE-2026-20272: Improper Neutralization of Special Elements in Output Used by a Downstream Component

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

CVE-2026-71202: Integer Underflow (Wrap or Wraparound)

The raster Rust crate's crop function src/editor.rs clamps the crop width/height against source dimensions but only clamps the offsetx/offsety parameters against 0, never against the source width/height...

CVE-2026-13477: Improper Neutralization of Special Elements used in an OS Command

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input...

CVE-2026-71203: Missing Authentication for Critical Function

changedetection.io's REST API resources are protected by an @auth.checktoken decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec changedetectionio/api/Spec.py, whose get method carries neither @auth.checktoken nor @validateopenapirequest...

CVE-2026-12730: Improper Validation of Certificate with Host Mismatch

IBM Business Automation Workflow containers and traditional 26.0.0, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 007, and 24.0.0 through 24.0.0 Interim Fix 009 IBM Business Automation Workflow fails to properly verify that the hostname matches the server certificate...

codex-security npm-v0.1.5

Codex Security @openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. See theCodex Security documentation for more details. Some cybersecurity requests and protected findings require approval through Trusted Access for Cyber. ...

vigolium v0.3.7

Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...

openvas-scanner v23.50.11

OpenVAS Scanner This is the OpenVAS Scanner of the Greenbone Community Edition. It is used for the Greenbone Enterprise appliances and is a full-featured scan engine that executes a continuously updated and extended feed of Vulnerability Tests VTs. Releases All release files are signed with the...

CVE-2026-59881 vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, dask-kubernetes, airflow, airflow-core, dask-kubernetes-fips, open-webui, apache-beam-python-3.13-sdk, text-generation-inference, py3-vllm-cuda-12.4, puppygraph-python, kserve-models-web-app, apache-beam-python-3.12-sdk, py3-cassandra-medusa, awx,...

GHSA-MQ44-7P77-Q5H7 vulnerabilities

Vulnerabilities for packages: lmcache-cuda-12.8, dask-kubernetes, airflow, airflow-core, dask-kubernetes-fips, open-webui, apache-beam-python-3.13-sdk, text-generation-inference, py3-vllm-cuda-12.4, puppygraph-python, kserve-models-web-app, apache-beam-python-3.12-sdk, py3-cassandra-medusa, awx,...

POC-keyv-and-cacheable-npm-Package

ChainDrop npm Supply Chain Attack — PoC Scanner & Exploit...

user-scanner v1.4.3

User Scanner A powerful 2-in-1 OSINT suite engineered for deep Email and Username Intelligence. With 380+ total scan vectors —including 155+ email-integrated sites and 225+ username platforms —you can map digital footprints, analyze target behavior, uncover interests, full metadata of usernames a...