CVE-2026-86520: Use of Hard-coded Credentials

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker...

EUVD-2026-60598

Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss, bypassing the page-content XSS safety gate...

CVE-2026-54597 ITFlow: Authenticated Time-Based Blind SQL Injection in ITFlow via expires Parameter

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with modulesupport write permission and access to a credential record can perform time-based blind SQL injection through the expires parameter of...

EUVD-2026-65215

Grav: Non constant time nonce comparison in Utils::verifyNonce used for CSRF protection...

GHSA-38P6-H87P-R4CG Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

Summary Grav\Common\Utils::verifyNonce, the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's === operator instead of hashequals. === on strings short circuits at the first differing byte, so the comparison time leaks how...

DEBIAN-CVE-2026-93146

In the Linux kernel, the following vulnerability has been resolved: time/namespace: Validate nanosecond field in proctimenssetoffset The function validates tvsec to be within -KTIMESECMAX, KTIMESECMAX but never validates that tvnsec is within the valid range of 0, NSECPERSEC-1 before using it in...

SUSE CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

CVE-2026-92987

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

AZL-105209 CVE-2026-92987 affecting package openvmm 0.1.0-1

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

CVE-2026-92987

A flaw was found in roxmltree. This vulnerability allows a remote attacker to cause a denial of service DoS by crafting a malicious XML document with a large number of attributes on a single element. The roxmltree library performs quadratic-time validation of attributes and namespaces during XML...

CVE-2026-92987 roxmltree through 0.21.1 Denial of Service via Quadratic Parsing

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

CVE-2026-90986

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.21 versions...

CVE-2026-92596

A flaw was found in Nodemailer's addressparser component. This vulnerability, due to quadratic time complexity, allows a remote attacker to cause a Denial of Service DoS. By sending a specially crafted email with a large, comma-separated list of addresses, the attacker can block the Node.js event...

EUVD-2026-81488

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.21 versions...

CVE-2026-90986

Unauthenticated Cross Site Scripting (XSS) in the WordPress plugin Visitor Traffic Real Time Statistics Pro affects versions ≤ 11.21 . The vulnerability requires user interaction but no prior authentication (CVSS v3.1: 7.1 HIGH , vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), with changed scope ind...

CVE-2026-90986 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.21 versions...

CVE-2026-90986 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.21 versions...

BIT-MONGODB-2026-18695 Improper Input Validation in MongoDB Timeseries Query Processing Leads to Denial of Service

An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write access to cause the server process to terminate unexpectedly, resulting in a denial of service...

EUVD-2026-81296

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the...

CVE-2026-90986: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.21 versions...