CVE-2026-13360

The CVE-2026-13360 entry concerns the WordPress plugin “WPLP Cookie Consent” (GDPR/CCPA banner). A Stored Cross-Site Scripting vulnerability exists via the regionArray parameter in all versions up to 4.3.5 due to insufficient input sanitization and output escaping, enabling injection of scripts t...

CVE-2026-57469

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469 Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-57469

Nozomi Networks Labs identifies a CSRF vulnerability (CWE-352) in the web-based configuration backend of KUNBUS PiCtory v2.16.0. The issue allows a remote unauthenticated attacker to perform state-changing actions within an authenticated operator session by tricking a victim into submitting craft...

CVE-2026-19794

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVE-2025-10308

The Astro Booking Engine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.0. This is due to missing nonce validation on the options deletion functionality. This makes it possible for unauthenticated attackers to delete all plugin settings...

CVE-2026-73292 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/id/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to...

CVE-2026-65789

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network...

CVE-2026-64912

Stack-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code locally...

CVE-2026-62820

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows DNS allows an unauthorized attacker to execute code over a network...

EUVD-2026-56773

Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network...

EUVD-2026-56770

Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally...

EUVD-2026-56709

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally...

EUVD-2026-56665

Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network...

EUVD-2026-56649

Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-68815

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-68795

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-68794

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

EUVD-2026-56427

Improper neutralization of special elements used in a command 'command injection' in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-18129

Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker in a MITM position to leak credentials for external SQL connections...