PT-2026-111389

Name of the Vulnerable Software and Affected Versions Industrial Edge App Publisher versions prior to V1.27.9 Description The software fails to properly validate the server certificate during the initiation of a TLS connection. This flaw enables a Man-in-the-Middle attack, where an attacker can...

CVE-2026-102250: Insufficient Verification of Data Authenticity

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

CVE-2026-78556: Improper Certificate Validation

A vulnerability has been identified in Industrial Edge App Publisher All versions V1.27.9. The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication Man-in-the-Middle attack and to spoof a...

PT-2026-113470

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in ShapeDetection. This allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by using a...

PT-2026-113493

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in the Network component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

PT-2026-113481

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue in the Browser component allows a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page. Use after free ...

PT-2026-113468

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in the PDF component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attacker...

PT-2026-113491

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description Incorrect authorization in the Updater allows a local attacker to execute arbitrary code outside the sandbox via a local program. A sandbox is a security mechanism used to isolate runni...

PT-2026-113552

Microsoft has released Patch Tuesday for October 2026 Microsoft has published its October security update package Patch Tuesday, which includes fixes for 1,413 vulnerabilities, three of which are classified as 0-days one of them is actively exploited in attacks. Of the fixed vulnerabilities, 79 a...

CVE-2026-109953: Insufficiently Protected Credentials

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode...

PT-2026-113490

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in the Passwords component. This allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by...

VulnCheck KEV: CVE-2024-8275

The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribehasnextevent' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

VulnCheck KEV: CVE-2026-49772

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2...

PT-2026-113497

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 155.0.8059.79 Description A use after free issue in Core allows a remote attacker to potentially execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page. Use after...

VulnCheck KEV: CVE-2026-2413

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the getglobalremediations method, where it is directly concatenated...

Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)

"The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8889-1 advisory. It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local...

CVE-2026-84418

IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API...

CVE-2026-84418 DataStage on Cloud Pak for Data Improper Certificate Validation

IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API...

CVE-2026-84418

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to a man-in-the-middle attack due to improper certificate validation (CWE-295). An attacker can present a forged TLS certificate to intercept the connection and capture the IAM bearer Authorization header automatically attached by the sess...

CVE-2026-109598 Frappe before 16.33.0 Broken Authorization via send_sms Endpoint

Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted sendsms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke sendsms to send arbitrary SMS...