CVE-2026-67357

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP getserversettings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-67357

ArcadeDB before 26.7.3 has an information-disclosure vulnerability in the MCP get_server_settings tool that leaks arcadedb.ha.clusterToken in cleartext. With MCP access, an attacker can use the cluster token via X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root an...

CVE-2026-67357 ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP getserversettings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-67357

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP getserversettings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

CVE-2026-67357 ArcadeDB before 26.7.3 Information Disclosure via get_server_settings

ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP getserversettings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can retrieve the cluster token and use it with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User...

EUVD-2026-51936

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...

PT-2026-67073

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable t...

PT-2026-67330

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.3 Description An information disclosure issue exists in the MCP get server settings tool. This flaw allows attackers with MCP access to retrieve the arcadedb.ha.clusterToken in cleartext. By using this token alo...

CVE-2026-67334 better-auth Stale Sessions Persist After User Deletion

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days...

CVE-2026-15244 HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view

The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered o...

DoS (Denial of Service) io.netty:netty-codec-http Dependency in Crowd Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 6.2.0, 6.3.0, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an...

Chromium: CVE-2026-18008 Inappropriate implementation in Settings

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-17916 Insufficient policy enforcement in Settings

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-13393

The ElementsKit Elementor Addons WordPress plugin (versions before 3.10.01 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to sanitize or escape specific megamenu menu-item settings before storage and front-end output, while also failing to require the u...

CVE-2026-13393

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfilteredhtml capability to save them, allowing users with administrative capabiliti...

CVE-2026-13393 ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfilteredhtml capability to save them, allowing users with administrative capabiliti...

EUVD-2026-51434

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfilteredhtml capability to save them, allowing users with administrative capabiliti...

CVE-2026-18008

An inappropriate implementation flaw was found in the Settings component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522412676...

PT-2026-66691

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered html capability to save them, allowing users with administrative...

Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2507)

Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware G 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to admin/logtonet.html or 2 kind parameter to fax/copysettings.html, a different vulnerability than...