EUVD-2026-90385

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where...

CVE-2026-102149 Kiteworks Email Protection Gateway Improper Access Control

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where...

Exploit for CVE-2026-103446

CVE-2026-103446: Anonymous WikiLambda fragment execution Repo...

CVE-2026-103476

The yii2-starter-kit software, version through 4.2.0 , is vulnerable to an unauthorized file download due to a failure to validate article publication status in the attachment-download endpoint. This flaw allows unauthenticated attackers to bypass authorization checks and retrieve files associate...

openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay

A flaw was found in OpenSSH's SSH daemon sshd. A remote attacker could exploit this vulnerability by repeatedly attempting authentication. The flaw allows the attacker to bypass the intended minimum authentication delay, which can facilitate brute-force attacks. This makes it easier for an attack...

USN-8858-1: Authen::SASL vulnerability

It was discovered that Authen::SASL, a Perl authentication library, did not properly validate login attempts. An attacker could possibly use this issue to gain unauthorized access...

USN-8858-1 libauthen-sasl-perl vulnerability

It was discovered that Authen::SASL, a Perl authentication library, did not properly validate login attempts. An attacker could possibly use this issue to gain unauthorized access...

openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay

A flaw was found in OpenSSH's SSH daemon sshd. A remote attacker could exploit this vulnerability by repeatedly attempting authentication. The flaw allows the attacker to bypass the intended minimum authentication delay, which can facilitate brute-force attacks. This makes it easier for an attack...

CVE-2026-103044

A flaw was found in the MediaWiki EasyTimeline extension. An Extensible Markup Language XML injection vulnerability exists due to improperly serving image map files as XML data. A remote attacker could exploit this flaw by convincing a user to interact with specially crafted content, potentially...

USN-8854-1: OpenStack Keystone vulnerabilities

Grzegorz Grasza discovered that OpenStack Keystone did not consistently enforce restrictions for delegated authentication tokens. An authenticated attacker could possibly use this issue to create credentials or delegations that outlasted the delegated token. CVE-2026-80182 It was discovered that...

CVE-2026-94672

The Safe SVG WordPress plugin (versions

CVE-2026-94672 WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References IDOR in Safe SVG = 2.5.0 versions...

CVE-2026-94173

The WordPress Business Directory plugin (versions

CVE-2026-62081

The Flexible PDF Coupons WordPress plugin versions

WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Brobicho in WordPress Plugin Flexible PDF Coupons versions = 1.14.11...

CVE-2026-10764 Information disclosure in BVMS 4.5 up to 12.3

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data...

EUVD-2026-89756

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data...

CVE-2026-102588

A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery CSRF token validation. By tricking an authenticated user with grade management permissions into visiting a malicious webpage, an attacker can trigger unauthorized requests on the victim's behalf. This...

CVE-2026-102585

A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses...

CVE-2026-102583

A flaw was found in Moodle. An incorrect capability check in the artificial intelligence AI editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This flaw permits unauthorized users to access and utilize the AI...