IServ Schoolserver User Enumeration

IServ Schoolserver suffers from a user enumeration vulnerability. The vendor does not feel this is an issue...

Flattening of vulnerability handling in SQLite through the SQLite Consortium

The SQLite Consortium has identified a vulnerability in SQLite version 3.41. This vulnerability relates to the expression evaluation logic of SQLite. An attacker can exploit this vulnerability remotely by submitting specially crafted malicious SQL statements. Exploitation may result in the...

CVE-2026-18591

A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument userid/phone number/email address/name leads to cleartext storage of sensitive...

EUVD-2026-52188

A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disrupti...

CVE-2026-9593

The CVE-2026-9593 entry describes a vulnerability in the iDTM FDI where an attacker with elevated privileges on the host can enable the debug interface by placing a crafted file in the application directory. This could lead to unauthorized access to connected devices and exposure, modification, o...

CVE-2026-16563

The Academy LMS WordPress plugin is affected pre-3.8.3. The REST API can return a single lesson without verifying the requester’s course enrollment or the lesson’s publication status, allowing a Subscriber-level user to disclose content from arbitrary lessons, including paid courses they are not ...

CVE-2026-15231

The CVE-2026-15231 entry affects the WordPress plugin “Tag, Category, and Taxonomy Manager” (TaxoPress) prior to version 3.51.0. Root cause: the plugin fails to verify a user’s authorization to access the referenced post before processing it and returning derived data. Impact: users with contribu...

CVE-2025-15672

The CVE concerns the ChamaWP WordPress plugin before 1.0.13. Affected component: PHP deserialization pathway where user input is not properly validated before being passed to a deserialization function. Root cause: unvalidated input enables unauthenticated attackers to inject arbitrary PHP object...

CVE-2026-13340

Summary (CVE-2026-13340): The SVG Support WordPress plugin is vulnerable before version 2.5.17 because SVG sanitisation is not applied to uploaded .svgz files, although these files are registered and served as SVG. This can let a user with upload permissions (e.g., an Author) store a script-beari...

CVE-2026-16274

CVE-2026-16274 concerns the Classified Listing WordPress plugin, versions before 5.4.4. The issue arises from a missing capability/ownership check on an AJAX action that returns a post’s content. This allows users with contributor-level access and above to read content from any post, page, or cus...

EUVD-2026-52153

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...

CVE-2026-18583

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mmsmapping/mmsmapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds read. The attack can be initiated...

EUVD-2026-52152

A weakness has been identified in mz-automation libiec61850 up to 1.6.1. This issue affects the function checkDataSetAccess of the file src/iec61850/server/mmsmapping/mmsmapping.c of the component MMS Request Handler. This manipulation causes out-of-bounds read. The attack can be initiated...

CVE-2026-13586 PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS)

In Bouncy Castle for Java before 1.85, PKCS12 MAC and bag-decryption KDF iteration-count bound DoS. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-13586

CVE-2026-13586 affects Bouncy Castle for Java: in versions prior to 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound introduces DoS risk; this also impacts Java LTS before 2.73.12 and BC-FJA before bc-fips 1.0.2.7 (1.0.x), 2.0.2 (2.0.x), and 2.1.3 (2.1.x). The available documents de...

CVE-2026-12860

In Bouncy Castle for Java before 1.85, RSA PKCS1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

EUVD-2026-52137

In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check...

CVE-2026-12816

In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12...

CVE-2026-58059 Quadratic-time escaping when stringifying X.500 distinguished names

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...

CVE-2026-58059

In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS BC-FJA before bc-fips 1.0.2.7 1.0.X series, 2.0.2 2.0.X series and 2.1.3 2.1.X series...