WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Devlin Jenkins in WordPress Plugin TrueBooker versions = 1.2.3...

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...

CVE-2026-92021

A use-after-free vulnerability exists in the JavaScript Engine: JIT component of the Firefox browser and Thunderbird mail client. This flaw was addressed in Firefox ESR 140.16 and Thunderbird 140.16 . No specific exploit details or in-the-wild exploitation information are provided in the documents.

CLSA-2026-1789465375 TuxCare security update for launch-editor (2 CVEs)

TuxCare rebuilt launch-editor to address 2 CVEs. Fixed in 2.2.1-tuxcare.1...

EUVD-2026-78262

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functionality of the file /deleterequirement.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The...

EUVD-2026-78231

A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been...

CVE-2026-90845 PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting

A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been...

PT-2026-92767

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segme...

PT-2026-92773

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

PT-2026-93067

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.2.26.0.000 Description A security flaw in the Security component allows a high privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a...

EUVD-2026-79297

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in director tags...

PT-2026-92174

Name of the Vulnerable Software and Affected Versions Dell Wyse Management Suite versions prior to 2605.0.3.683 Description A missing cryptographic step allows a high privileged attacker with remote access to potentially perform information tampering. Recommendations Update to version 2605.0.3.68...

Security update for kimi-code (moderate)

openSUSE security update: security update for kimi-code ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21849-1 Rating: moderate References: bsc1268927 bsc1269951 Cross-References: CVE-2026-45736 CVE-2026-48779 CVSS scores: CVE-2026-45736 SUSE : 4.4...

PT-2026-91998

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 156 Firefox ESR versions prior to 153.3 Thunderbird versions prior to 156 Thunderbird versions prior to 153.3 Description Privilege escalation in the Session Restore component. Recommendations Update Firefox to versio...

CVE-2026-88743

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in director tags...

CVE-2026-88743

Versions 4.7.0 - 6.5.0 of Bacularis are vulnerable to Stored cross-site scripting (XSS) within director tags . This vulnerability is caused by the improper neutralization of input during web page generation. The documents do not provide specific information regarding a root cause, practical impac...

CVE-2025-66974: Improper Input Validation

An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service DoS or connection to an attacker-controlled device via supplying a crafted packet during the provisioning phase...

CVE-2026-90842 PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

CVE-2026-19290

IBM Sterling File Gateway is affected by an improper access control flaw (CWE-284) that allows a remote, unauthenticated attacker to obtain sensitive information over the network. The vulnerability impacts versions 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1 , ...

CVE-2026-84491

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data...