EUVD-2026-49709

The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billingphone parameter. This is due to the processRegistration...

USN-8615-1: Linux kernel vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

PT-2026-65517

Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return 0x0D or line feed 0x0A bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflecte...

PT-2026-65502

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnecttrue is enabled, AppiumCommandExecutor.setDirectConnect reads the directConnectHost, directConnectPort, and directConnectPath fields from...

PT-2026-65523

tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return 0x0D and line feed 0x0A bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can explo...

PT-2026-65590

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS affected versions not specified MikroTik Cloud Hosted Router affected versions not specified Description A weakness exists in the API authentication handling that lacks effective safeguards against excessive login attempts. T...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework [CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854]

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Spring Framework CVE-2026-41839, CVE-2026-41840, CVE-2026-41845, CVE-2026-41853, CVE-2026-41854. Spring Framework is used as part of our microservices. These vulnerabilities have been addressed. Please read the detai...

CVE-2026-66824 Stored Cross-Site Scripting via Unsafe Capture Tree JSON Embedding

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...

CVE-2026-66824

CVE-2026-66824 is a stored XSS vulnerability in the capture tree visualization page. The app embeds the serialized capture tree directly into an inline JavaScript block via the Jinja safe filter. Attackers can craft values from captured content that terminate the [removed] tag and inject arbitrar...

libssh2: libssh2: Arbitrary code execution via double-free in SFTP session

A flaw was found in libssh2. A malicious SSH Secure Shell server can exploit a double-free vulnerability in the sftpopen function. This flaw allows the server to corrupt the heap memory of an authenticated client when it opens an SFTP SSH File Transfer Protocol session. This heap corruption can...

CVE-2026-59239

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-59239

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-59239 Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-59239 Stored XSS in Prospero Flow CRM email body allows administrator account takeover

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

EUVD-2026-49389

Stored Cross-site Scripting CWE-79 in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to session compromise and account takeover, via a payload...

CVE-2026-59239

CVE-2026-59239: Stored XSS in Roskus Prospero Flow CRM 5.4.x email module allows remote, authenticated low-privilege users to inject JavaScript via a stored payload in email bodies, rendered unescaped with {!! $email->body !!} and executable in recipient browsers (including admins), enabling s...

CVE-2026-12990

An access control vulnerability in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active,...

CVE-2026-12990 Multiple vulnerabilities in Ghost Robotics' Vision 60

An access control vulnerability in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active,...

CVE-2026-12990

CVE-2026-12990 describes an access-control vulnerability in Ghost Robotics’ Vision 60 mobile app (APK v5.5.0). The issue allows multiple simultaneous sessions without proper client validation or session integrity checks, enabling a modified app to connect during an active legitimate session. Impa...

EUVD-2026-49180

An access control vulnerability in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows multiple simultaneous sessions to run without proper client validation or session integrity checks. An attacker with a modified version of the app can connect to the robot during an active,...