CVE-2026-41512: Improper Control of Generation of Code

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a remote code execution vulnerability via JavaScript injection in BrowserAutomation::PlaywrightService. This issue has been patched in version 1.4.1...

CVE-2026-44927: Numeric Truncation Error

In uriparser before 1.0.2, there is pointer difference truncation to int in various places...

CVE-2026-29201: Relative Path Traversal

Insufficient input validation of the feature file name in feature::LOADFEATUREFILE adminbin call can cause arbitrary file read when a relative file path is passed...

Wordfence Intelligence Weekly WordPress Vulnerability Report (April 27, 2026 to May 3, 2026)

Last week, there were 87 vulnerabilities disclosed in 198 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 61 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities ...

Exploit for Incorrect Implementation of Authentication Algorithm in Google Android

CVE-2026-0073 — Android ADB TLS Authentication Bypass A proof...

CVE-2026-39836: Undefined Security Weakness

The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0...

CVE-2026-39820: Allocation of Resources Without Limits or Throttling

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations...

CVE-2026-37709: Improper Access Control

Insecure Permissions vulnerability in grokability snipe-it v.8.4.0 and before and fixed after 2026-03-10 commit 676a9958 allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component...

CVE-2026-39823: Undefined Security Weakness

CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the attribute, the escaper would fail to similarly escape it, leading to XSS...

CVE-2025-65122: Uncontrolled Resource Consumption

Regex Denial of Service in youtube-regex npm package through version 1.0.5...

CVE-2025-63705: Improper Neutralization of Special Elements used in an OS Command

NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js...

CVE-2025-63706: Improper Control of Generation of Code

NPM package next-npm-version1.0.1 is vulnerable to Command injection...

CVE-2026-42499: Creation of Immutable Text Using String Concatenation

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

CVE-2026-33814: Loop with Unreachable Exit Condition

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGSMAXFRAMESIZE with a value of 0...

CVE-2026-25436: Missing Authorization

Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal Elementor Addons: from n/a before 1.7.1053...

CVE-2026-27415: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in PluginUs.Net BEAR allows Cross Site Request Forgery. This issue affects BEAR: from n/a through 1.1.5...

CVE-2025-66105: Missing Authorization

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Bus Ticket Booking with Seat Reservation: from n/a before 5.6.8...

CVE-2024-43384: Improper Removal of Sensitive Information Before Storage or Transfer

A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer...

CVE-2026-5791: Cross-Site Request Forgery (CSRF)

Cross-Site request forgery CSRF vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross Site Request Forgery. This issue affects DivvyDrive: from 4.8.2.9 before 4.8.3.2...

Linux Distros Unpatched Vulnerability : CVE-2026-7963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to...