Vulnerabilities in Adobe Commerce

Adobe has identified several vulnerabilities in Adobe Commerce. These vulnerabilities involve stored Cross-Site Scripting XSS, where attackers can inject malicious JavaScript code into form fields within the application. This code is executed in the victim’s browser and can perform unauthorized...

EUVD-2026-102684

The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions...

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

CVE-2026-111389

The Frappe HRMS software contains a SQL injection vulnerability in several endpoints across versions 14.x before 14.38.2 , 15.x before 15.64.0 , and 16.x before 16.18.0 . The root cause is missing input validation , which allows an authenticated attacker (including those with low-privilege accoun...

EUVD-2026-102532

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications...

CVE-2026-16754

A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that could allow an adjacent user to intercept or manipulate network communications...

Linux Distros Unpatched Vulnerability : CVE-2026-103503

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued...

PT-2026-115891

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash...

CVE-2026-18560: Observable Discrepancy

Mattermost versions 11.10.x = 11.10.0, 11.7.x = 11.7.9, 11.9.x = 11.9.1, 11.8.x = 11.8.5 fail to validate user’s permissions before other validations which allows non-content reviewers to infer a post’s flagged status via direct API call.. Mattermost Advisory ID: MMSA-2026-00754...

PT-2026-115599

Name of the Vulnerable Software and Affected Versions luksmeta affected versions not specified Description Improper boundary validation of metadata slots allows an attacker who can supply or modify a disk header to redirect wipe or load operations outside the intended metadata area. By providing ...

CVE-2026-111555: Improper Validation of Specified Index, Position, or Offset in Input

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with...

PT-2026-115864

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user controlling a Kubernetes agent to cause sensitive authentication tokens to be sent to...

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

The MCP Apps UI resource an interactive DataStore table rendered in the host's webview/iframe communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''. Any window/frame able to reach th...

PT-2026-115903

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash through Authentication.validateFingerPrint, but Ed25519PasswordAuth.hash...

Linux Distros Unpatched Vulnerability : CVE-2026-105280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE...

Zoom Rooms 7.0.x < 7.1.7 Improper Certificate Validation (ZSB-26021)

The version of Zoom Rooms installed on the remote host is 7.0.x prior to 7.1.7. It is, therefore, affected by a vulnerability as referenced in the ZSB-26021 advisory. - Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information...

Microsoft Power Apps < 3.26085.3.0 Remote Code Execution (October 2026)

The Windows 'Microsoft Power Apps' app installed on the remote host is prior to version 3.26085.3.0. It is, therefore, affected by a remote code execution vulnerability: - Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network. CVE-2026-70213...

Linux Distros Unpatched Vulnerability : CVE-2026-111555

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe...

CVE-2026-96620: Improper Input Validation

Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causin...

Linux Distros Unpatched Vulnerability : CVE-2026-96222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper certificate validation in Active Directory Federation Services AD FS allows an unauthorized attacker to perform spoofing over a network. CVE-2026-96222...