CVE-2026-60074

Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with the \d shorthand, which on a character string matches the whole Unicode decimal digit property \pNd and not...

WordPress TheCartPress eCommerce Shopping Cart plugin <= 1.5.3.6 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by spacehen in WordPress Plugin TheCartPress versions = 1.5.3.6...

WordPress Cherry Framework theme <= 3.1.4 - Unauthenticated Backup Download vulnerability

Unauthenticated Backup Download vulnerability discovered by ? in WordPress Theme Cherry Framework versions = 3.1.4...

WordPress IMDB Profile Widget plugin <= 1.0.8 - Unauthenticated Local File Inclusion vulnerability

Unauthenticated Local File Inclusion vulnerability discovered by CrashBandicot @DosPerl in WordPress Plugin IMDb Profile Widget versions = 1.0.8...

WordPress HB Audio Gallery Lite plugin <= 1.0.0 - Unauthenticated Arbitrary File Download vulnerability

Unauthenticated Arbitrary File Download vulnerability discovered by CrashBandicot in WordPress Plugin HB Audio Gallery Lite versions = 1.0.0...

openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the scp command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to...

WordPress Easy Appointments plugin <= 3.12.26 - Contributor+ Customer Data Disclosure vulnerability

Contributor+ Customer Data Disclosure vulnerability discovered by Mustafa Ahmed in WordPress Plugin Easy Appointments versions = 3.12.26...

bramble v1.11.0-chromium

Bramble A password manager that keeps your secrets on your own devices. No account, no server holding your vault, no company to get breached and leak everything. You hold the vault, you hold the password, and that's it. Bramble runs where you do: Browser extension for Chromium browsers Brave,...

EUVD-2026-50964

A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...

CVE-2026-67246

CVE-2026-67246 is a path traversal vulnerability in the Wallpaper component of ADM. Authenticated users can supply a crafted wallpaper path input that is not sufficiently validated before file access, allowing access to or manipulation of files outside the intended wallpaper directory, constraine...

CVE-2026-16092

The CVE-2026-16092 entry concerns The Improved Save Button plugin for WordPress. A second-order SQL injection affects all versions up to 1.2.1 via the ‘meta_key’ Custom Field when using the ‘Save and Duplicate’ action. Root cause: insufficient escaping of user-supplied parameters and inadequate p...

CVE-2026-18188

A format string vulnerability was found in the Rsync Backup on the ADM. The vulnerability occurs because user-controlled rsync backup configuration or log data may be processed through an unsafe format string operation. An authenticated attacker can exploit this issue to disclose memory informati...

Out-of-bounds Read

Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec

A flaw was found in Netty. A remote attacker can exploit a vulnerability in the SpdyHttpDecoder handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated SYNSTREAM frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This...

DEBIAN-CVE-2026-17803

Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. Chromium security severity: Medium...

CVE-2026-17803

Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. Chromium security severity: Medium...

DEBIAN-CVE-2026-17748

Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17803

Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted PDF file. Chromium security severity: Medium...

CVE-2026-18016

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2026-17813

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Chromium security severity: Medium...