CVE-2026-78556

A vulnerability has been identified in Industrial Edge App Publisher All versions V1.27.9. The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication Man-in-the-Middle attack and to spoof a...

EUVD-2026-98067

IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API...

VulnCheck KEV: CVE-2024-8275

The The Events Calendar plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tribehasnextevent' function in all versions up to, and including, 6.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

VulnCheck KEV: CVE-2025-1702

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'search' parameter in all versions up to, and including, 2.10.0 due to insufficient escaping on the user suppli...

VulnCheck KEV: CVE-2026-49772

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16.2...

VulnCheck KEV: CVE-2026-2413

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3. This is due to insufficient escaping on the user-supplied URL parameter in the getglobalremediations method, where it is directly concatenated...

PT-2026-111389

Name of the Vulnerable Software and Affected Versions Industrial Edge App Publisher versions prior to V1.27.9 Description The software fails to properly validate the server certificate during the initiation of a TLS connection. This flaw enables a Man-in-the-Middle attack, where an attacker can...

PT-2026-113497

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 155.0.8059.79 Description A use after free issue in Core allows a remote attacker to potentially execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page. Use after...

PT-2026-113468

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in the PDF component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attacker...

PT-2026-113470

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in ShapeDetection. This allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by using a...

PT-2026-113493

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in the Network component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

PT-2026-113491

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description Incorrect authorization in the Updater allows a local attacker to execute arbitrary code outside the sandbox via a local program. A sandbox is a security mechanism used to isolate runni...

CVE-2026-102250: Insufficient Verification of Data Authenticity

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device...

PT-2026-113552

Name of the Vulnerable Software and Affected Versions MessagePack for C versions prior to 2.5.303 MessagePack for C versions prior to 3.1.9 Description Deserializing attacker-controlled MessagePack data as System.Object through the PrimitiveObjectFormatter function can lead to excessive memory...

Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)

"The remote Ubuntu 26.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8889-1 advisory. It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local...

PT-2026-113490

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue exists in the Passwords component. This allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by...

CVE-2026-109953: Insufficiently Protected Credentials

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode...

CVE-2026-78556: Improper Certificate Validation

A vulnerability has been identified in Industrial Edge App Publisher All versions V1.27.9. The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication Man-in-the-Middle attack and to spoof a...

PT-2026-113481

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description A use after free issue in the Browser component allows a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a crafted HTML page. Use after free ...

CVE-2026-84418

IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API...