CVE-2026-118255

A flaw was found in Highcharts Grid. The component fails to validate URL schemes in credit links, allowing an attacker who controls the grid configuration to inject a malicious JavaScript link. When a user clicks the link, arbitrary script executes within the origin of the hosting web application...

Navidrome <=0.54.5 - Authentication Bypass in Subsonic API

Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system,...

WordPress Simple Job Board - Unauthorized Data Access

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

WordPress Better Search < 4.5.3 - Unauthenticated Arbitrary Post Type Content Disclosure

WebberZone Better Search = 4.5.2 contains a broken access control caused by incorrectly configured access control security levels, letting attackers exploit unauthorized access, exploit requires no special privileges. id: CVE-2026-119495 info: name: WordPress Better Search 4.5.3 - Unauthenticated...

CVE-2026-122038

A flaw was found in EmployeeRecruitmentSystem. A remote, unauthenticated attacker can submit specially crafted input to the Requirement Board Update Handler source/reqformprocessing.php, leading to a Structured Query Language SQL injection vulnerability. This flaw allows an attacker to execute...

CVE-2026-54382

A flaw was found in the VitaFit cloud API. An authenticated remote attacker can exploit overly permissive Amazon Web Services AWS role permissions to upload files across an entire shared Amazon Simple Storage Service S3 bucket rather than remaining restricted to their designated folder. This allo...

CVE-2026-123095

A flaw was found in mpv. A remote attacker who controls a media feed or webpage can exploit this vulnerability by injecting newline characters into playlist URLs processed by the bundled ytdlhook script. This allows the attacker to bypass URL safety checks and load arbitrary local files or shared...

CVE-2026-1907

A flaw was found in Kong Gateway. A SQL injection vulnerability exists in its clustering communication logic when operating in Hybrid Mode. An authenticated attacker with network access to the Control Plane clustering port and a valid client certificate can exploit this flaw by sending specially...

CVE-2026-107014

A flaw was found in Bander Notepad. Due to insecure permission configurations, an unauthorized attacker can read and modify note databases belonging to other users. This issue leads to information disclosure and unauthorized data modification...

CVE-2026-118668

A flaw was found in langgraph-api. In deployments using JavaScript or TypeScript custom authorization handlers, rewritten storage namespaces intended to isolate tenant data are not properly enforced across the runtime boundary before storage operations execute. An authenticated remote attacker ca...

CVE-2026-111866

A flaw was found in manong. Due to improper input sanitization in the func.php script, the application is vulnerable to Structured Query Language SQL injection. A remote attacker can exploit this flaw by sending specially crafted input to affected database functions, allowing them to manipulate...

CVE-2026-110733

A flaw was found in the Apache SIS SQL storage module. When sorting a stream of features, the application appends sort clauses to database queries after the ORDER BY statement without properly quoting identifier characters. An attacker capable of supplying a crafted sort clause could exploit this...

CVE-2026-109965

A flaw was found in Serena. This vulnerability allows an attacker to access or overwrite sensitive files outside the intended project directory by tricking a user into opening a repository containing crafted symbolic links shortcuts pointing to other file locations. Because file path validation...

openjdk: Enhance HTTP Client (Oracle CPU 2026-10)

A flaw was found in OpenJDK's Networking component. An unauthenticated remote attacker with network access can exploit this vulnerability by sending crafted input to exposed networking Application Programming Interfaces APIs. Successful exploitation allows the attacker to perform unauthorized dat...

openjdk: Enhance Preferences (Oracle CPU 2026-10)

A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces APIs can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an...

openjdk: Enhance JShell (Oracle CPU 2026-10)

A flaw was found in OpenJDK's JDK tools component. An unauthenticated local attacker can exploit this vulnerability by convincing a user to interact with untrusted code in an environment relying on the Java security sandbox. A successful attack can result in unauthorized creation, modification, o...

openjdk: Enhance jstatd (Oracle CPU 2026-10)

A flaw was found in the Serviceability component of OpenJDK. An unauthenticated remote attacker can exploit this issue across the network by supplying crafted data to exposed application programming interfaces APIs or by running untrusted code within a sandboxed Java environment. Successful...

openjdk: Enhance Network Clients (Oracle CPU 2026-10)

A flaw was found in the OpenJDK networking component. This vulnerability may allow an unauthenticated remote attacker to cause unauthorized data modification. By supplying crafted input to exposed networking application programming interfaces APIs, such as through a web service, an attacker can...

openjdk: Enhance Template Handling (Oracle CPU 2026-10)

A flaw was found in the JAXP Java API for XML Processing component of OpenJDK. An unauthenticated remote attacker can exploit this vulnerability by providing crafted input to applications or web services that process data through JAXP APIs. Successful exploitation allows the attacker to perform...

openjdk: Enhance Preferences (Oracle CPU 2026-10)

A flaw was found in the OpenJDK Utility component. An unauthenticated attacker with local system access or the ability to supply data to affected application programming interfaces APIs can exploit this vulnerability. Successful exploitation can result in unauthorized data access, allowing an...