CVE-2026-44092

A flaw was found in ModbusServer. An unauthenticated remote attacker can inject malicious input into the application due to a lack of input validation when fetching data from MQTT. This vulnerability may lead to a loss of data integrity and system availability...

Linux Distros Unpatched Vulnerability : CVE-2026-54338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators c...

CVE-2026-18353

A flaw was found in PIA. An unauthenticated attacker can exploit a Server-Side Request Forgery SSRF vulnerability by crafting a malicious OpenID Connect OIDC issuer URL. This bypasses an internal allowlist due to inconsistent URL parsing between Python's urlparse and the requests/urllib3 librarie...

CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-20345

A vulnerability in the GPT file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition or possibly other expanded impacts as a result of memory corruption on an affected device. This vulnerability is due to improper handling of an endian conversion...

CVE-2026-20346

Summary: CVE-2026-20346 affects the PDF file format parser in ClamAV. The vulnerability arises from improper boundary checks during PDF content processing, leading to an out-of-bounds buffer read and memory corruption. Impact as described: An unauthenticated, remote attacker can submit a crafted ...

EUVD-2026-54474

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2026-15208

The CVE pertains to the RegistrationMagic WordPress plugin prior to 6.0.9.5. The vulnerability arises because the server-side check only verifies that the PayPal capture status is COMPLETED, without validating the capture amount, currency, payee, or prior use against the target registration. This...

RCE (Remote Code Execution) form-data Dependency in Jira Software Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.7 and...

DoS (Denial of Service) brace-expansion Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.7 and a CVSS Vector o...

CVE-2026-66370

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction...

CVE-2026-71324

CVE-2026-71324 (Traefik) : Unauthenticated cross-user response poisoning via proxied CONNECT on Traefik’s shared backend keep-alive pool. Traefik forwards HTTP/2/HTTP/3 CONNECT and its body to an HTTP/1.1 upstream through a shared net/http.Transport. If the upstream returns a keep-alive non-2xx a...

EUVD-2026-54083

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

EEF-CVE-2026-66370 html_sanitize_ex HTML5 scrubber keeps attacker-supplied form-association attributes, allowing form hijacking

Summary URL Redirection to Untrusted Site 'Open Redirect' vulnerability in the HTML5 scrubber in rrrene html\sanitize\ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and...

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client (VSI) before version 10.11.1.0 contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could execute arbitrary OS commands on the VSI host with root privileges, potentially leading to full sy...

CVE-2026-0673

The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...

CVE-2026-66733

Sonic 3 A.I.R. is affected by an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() prior to commit 2492d18. The mUniquePacketID field is read directly from the UDP wire-format header without bounds checking, causing the server to allocate one CacheItem per missing ...

CVE-2025-15028

The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This...

CVE-2026-71314

Nuxt (Vue.js framework) is affected by CVE-2026-71314 in versions 3.1.0 through 3.21.10 and 4.5.1. An unauthenticated attacker can trigger unbounded server-side rendering memory growth via a server island v-for prop (including vforToArray and related usage), leading to memory exhaustion and a Nux...