CVE-2026-66030

Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and...

PatchScope

PatchScope Match an installed-software inventory against know...

EUVD-2026-49252

Unauthenticated Broken Access Control in Gillion = 4.13 versions...

CVE-2026-66448 WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...

CVE-2026-59548

Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...

CVE-2026-59690

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...

CVE-2026-59686

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...

BIT-DOTNET-SDK-2026-47302 .NET Denial of Service Vulnerability

Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

Openfire Administration Console - Authentication Bypass

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup...

Malicious Package

Overview @ceeferenderer/itg-renderer-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious code in fazzanime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 078273c8fb515986eb1019d1fbd9f00c675790be7144b7a68680374352f55881 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-59687: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location...

Poly PrivateConnect – Potential Remote Code Execution

A potential security vulnerability has been identified in Poly PrivateConnect devices using Pexip, which might allow remote code execution. Pexip has released updates to mitigate the potential vulnerabilities. HP has identified affected products with minimum versions that mitigate the potential...

CVE-2026-59689: Incorrect Authorization

An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system...

PT-2026-64901

Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress ECS Connection Manager affected versions not specified Progress Object Scale Connection Manager affected versions not specified Progress MOVEit WAF affected versions not...

PT-2026-65385

Impact It's possible to forge a request to delete a message. Patches The problem has been patched in version 2.0-rc-1 of Discussion Extension. Workarounds There's no easy workaround except upgrading. References https://jira.xwiki.org/browse/DISCUSSION-22 For more information If you have any...

CVE-2026-59688: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore...

PT-2026-64894

Forensic Master Report: API and GPS Infrastructure Interference 1. Threat Actor Identification and Landscape Forensic telemetry identifies a multi-tiered adversarial campaign characterized by a sophisticated coordination between institutional actors and Advanced Persistent Threat APT groups. The...

CVE-2026-59686: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...

CVE-2026-59690: Missing Authorization

A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be...