EUVD-2026-76159

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

CVE-2026-87776 compression vulnerable to Denial of Service via memory leak on premature response close

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-17037

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-76028

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-76006

WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the same network can intercept a student's connection packet and replay it, thereby forging the appearance that the student remains connected...

CVE-2026-89179

WeenyGenius , a computer lab management system by Howyar Technologies , is affected by a Missing Support for Integrity Check vulnerability. An unauthenticated attacker on the same (adjacent) network can intercept a student's connection packet and replay it, forging the appearance that the student...

CVE-2026-89178

WeenyGenius , a computer lab management system by Howyar Technologies , suffers from an Origin Validation Error that allows unauthenticated attackers on the same network to spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection wit...

CVE-2026-89178 Howyar｜WeenyGenius - Origin Validation Error

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection with the...

EUVD-2026-76002

Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values...

EUVD-2026-76000

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

CVE-2026-89173

The Smart Video Intercom System developed by Kingdom Communication Associated is affected by a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses, allowing them to discover which accounts exist on...

CVE-2026-89173 Kingdom Communication Associated｜Smart Video Intercom System - Sensitive Data Exposure

Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses...

EUVD-2026-75976

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single reques...

CVE-2026-18561

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in...

EUVD-2026-75941

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18562 HUSKY <= 1.4.3 - Reflected Cross-Site Scripting

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wploadjs...

EUVD-2026-75935

The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-56158-.NET-Framework-RCE-PoC-Exploit

CVE-2026-56158 — .NET Framework Remote Code Execution RCE PoC Exploit Critical CVSS 9.8 — Deserialization of Untrusted Data CWE-502 in Microsoft .NET Framework & .NET Runtime Patched: July 14, 2026 | Attributed to: Positive Technologies PT-2026-60174 Table of Contents Overview Vulnerability Detai...

PT-2026-90003

Chamilo LMS before 1.11.42 and 3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious script payloads into survey answers by computing deterministic invitation codes and bypassing authorization checks in the survey submission endpoint...

PT-2026-90496

Concrete CMS 9.5.2 and below is vulnerable to Cross-Site Request Forgery CSRF in the Express "Clear Entries" function POST /index.php/dashboard/system/express/entities/delete entries because the controller records but does not enforce a failed CSRF token check, allowing the destructive operation ...