CVE-2026-76653

A missing authentication flaw in the VPN configuration management interface of TP-Link Archer MR600 (firmware v2, v3, and v5) and TL-MR6400 (firmware v8) stems from improper access control , allowing a remote unauthenticated attacker on an adjacent network to disclose and modify VPN configuration...

EUVD-2026-75726

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 v2, v3 & v5 and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials...

CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054

CVE-2026-89054 is a missing authorization vulnerability in OpenNMS Horizon . The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH , leaving the shipped @PATCH endpoints for event configuration and SNMP data collection accessible withou...

EUVD-2026-75707

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-88059

A flaw was found in Angular. When Server-Side Rendering SSR and hydration are used with a hierarchical HttpClient configured with withRequestsMadeViaParent, the HttpTransferCache can improperly cache authenticated responses. This occurs because a child TransferCache stores private response data i...

CVE-2026-88062

OmniRoute (open-source AI gateway) versions 3.8.49 and earlier are affected by a remote code execution flaw in the POST /api/acp/agents custom ACP agent endpoint. Attacker-controlled binary and versionCommand values pass a self-consistency check and a limited metacharacter filter (tokenizeVersion...

CVE-2026-88061 career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...

CVE-2026-88061 career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution

career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page ...

CVE-2026-88061

career-ops (an open-source AI-assisted job search tool) prior to 0.8.0 exposed its local web dashboard (web/) /api routes for command-spawning and user-file-writing without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could issue ...

Imperva Customers Protected Against StyleSmuggler (CVE-2026-75650) in Adobe Commerce and Magento Open Source

TL;DR:CVE-2026-75650 , dubbed StyleSmuggler, is a critical vulnerability affecting Adobe Commerce and Magento Open Source. The vulnerability allows an unauthenticated attacker to inject malicious PHP code into Magento’s template system and achieve remote code execution. Adobe assigned the...

WordPress Unlimited Elements For Elementor plugin <= 2.0.16 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Unlimited Elements For Elementor Free Widgets, Addons, Templates versions = 2.0.16...

CVE-2026-88045

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

CVE-2026-85228

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library DJL from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To...

CVE-2026-65638

Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software originally distributed by ConfigServer, as well...

WordPress MIPL Grouped Checkout Fields for WooCommerce plugin <= 1.2.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Farrukh Ziyaev in WordPress Plugin MIPL Grouped Checkout Fields for WooCommerce versions = 1.2.2...

CVE-2026-85228

An integer overflow in the tensor buffer validation component of Amazon Deep Java Library (DJL) versions 0.13.0 through 0.36.0 (all platforms) allows a remote unauthenticated actor to read information from adjacent process memory or trigger a denial of service by submitting a crafted tensor paylo...

CVE-2026-85228 Integer overflow in tensor buffer validation in Deep Java Library

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library DJL from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To...

EUVD-2026-75623

An integer overflow in the tensor buffer validation component in Amazon Deep Java Library DJL from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent process memory or cause a denial of service via a crafted tensor payload. To...