CVE-2026-21385

CVE-2026-21385 is a memory corruption vulnerability in the Qualcomm Display component (graphics) used by Qualcomm chipsets, caused by memory alignment handling during allocation. Exploitation has been observed in the wild in a limited, targeted manner, with attackers able to push malicious data t...

CVE-2026-3395

Summary (CVE-2026-3395): MaxSite CMS up to 109.1 contains a flaw in the MarkItUp Preview AJAX Endpoint (preview-ajax.php) where unsanitized input is passed to run_php and evaluated via PHP eval(), enabling unauthenticated remote code execution. This is driven by weak authorization checks in the M...

CVE-2026-28517

CVE-2026-28517 : openDCIM 23.04 (through commit 4467e9c4) contains an OS command injection in report_network_map.php. The app reads the database-sourced fac_Config.dot value and passes it directly to exec() without validation, enabling an attacker who can modify that value to execute arbitrary co...

CVE-2026-28515

CVE-2026-28515 overview (openDCIM 23.04 and earlier commits 4467e9c4): The installer and upgrade/LDAP configuration endpoints (install.php and container-install.php) fail to enforce application role checks, allowing any authenticated user to modify configuration when REMOTE_USER is set or when cr...

CVE-2026-28414

CVE-2026-28414 : The issue affects Gradio prior to 6.7 on Windows with Python 3.13+. A bug in Gradio’s path-joining logic, triggered by Python 3.13+ changes to os.path.isabs, allows an unauthenticated attacker to read arbitrary files from the Gradio server via root-relative paths. The vulnerabili...

CVE-2026-1557

The CVE-2026-1557 entry concerns the WordPress WP Responsive Images plugin (

CVE-2026-22719

CVE-2026-22719 describes a command injection vulnerability in VMware Aria Operations that could allow an unauthenticated attacker to execute arbitrary commands and potentially achieve remote code execution during support‑assisted product migration. Affected product is VMware Aria Operations (8.x ...

CVE-2026-21902

CVE-2026-21902 affects Juniper Networks Junos OS Evolved on PTX Series and is an unauthenticated, network-based remote code execution via the On-Box Anomaly Detection framework. The root cause is an incorrect permission assignment that exposes a service intended for internal processes to the exte...

CVE-2026-20122

Cisco Catalyst SD-WAN Manager API vulnerability (CVE-2026-20122) affects the Cisco Catalyst SD-WAN Manager, including the Data Collection Agent service. The root cause is improper file handling and privileged API usage on the API interface, enabling an authenticated, remote attacker with valid re...

CVE-2026-20127

CVE-2026-20127 concerns a vulnerability in the peering authentication of Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage). The flaw allows an unauthenticated, remote attacker to bypass authentication and obtain administrative pr...

CVE-2026-20128

CVE-2026-20128 affects Cisco Catalyst SD-WAN Manager: Data Collection Agent stores the DCA password in a recoverable credential file on the filesystem, enabling an authenticated, local attacker with valid vManage credentials to read the file and gain DCA user privileges, potentially compromising ...

CVE-2026-20133

Cisco Catalyst SD-WAN Manager (vManage) contains a vulnerability that could let an unauthenticated/low-privilege attacker view sensitive information on the underlying OS due to insufficient file system access restrictions, with descriptions indicating that access to the vshell or API could lead t...

CVE-2025-69985

CVE-2025-69985 affects FUXA 1.2.8 and earlier. The issue is an authentication bypass in server/api/jwt-helper.js that improperly trusts the HTTP Referer header, allowing unauthenticated remote access to the protected /api/runscript endpoint and arbitrary Node.js code execution. Public references ...

CVE-2025-68043

CVE-2025-68043 is a Missing Authorization / Broken Access Control vulnerability in the WordPress plugin LottieFiles (versions <= 3.0.0). The NVD and nuclei/patch sources describe an insecure access control configuration that lets an attacker bypass authorization and access or modify restricted...

CVE-2026-26980

CVE-2026-26980 is Ghost CMS unauthenticated SQL injection in the Content API (pre-6.19.1). Affected Ghost versions are 3.24.0 through 6.19.0; fixed in 6.19.1. The vulnerability allows reading arbitrary data from the database, with reports indicating attackers can exfiltrate sensitive data such as...

CVE-2026-1581

CVE-2026-1581 affects wpForo Forum for WordPress up to version 2.4.14, where the GET parameter wpfob used for ORDER BY is unsafely concatenated into SQL, enabling time-based SQL injection and potential data disclosure. Public connected documents confirm the vulnerability is due to insufficient es...

CVE-2025-71243

SPIP Saisies plugin 5.4.0–5.11.0 is affected by an unauthenticated remote code execution vulnerability. The _anciennes_valeurs parameter is injected into a hidden field and, because SPIP renders it with interdire_scripts = false and the template is evaluated via PHP, injected PHP is executed on t...

CVE-2026-23541

CVE-2026-23541 is a Missing Authorization vulnerability in the WordPress plugin Mail Mint (Mail Mint: 1.19.4 and earlier). The issue arises from functionality being accessible without proper ACL constraints, enabling access to previously restricted features. Documented impact indicates a broken a...

CVE-2026-1994

Summary (CVE-2026-1994): The WordPress plugin s2Member is affected by a critical (CVSS 3.1: 9.8) unauthenticated privilege-escalation via account takeover vulnerability affecting versions up to 260127. Root cause: the plugin fails to properly validate a user’s identity before updating a password,...

CVE-2026-1405

WordPress Slider Future plugin (versions ≤ 1.0.5) is vulnerable to an Unauthenticated Arbitrary File Upload due to missing file type validation in slider_future_handle_image_upload. This allows unauthenticated attackers to upload arbitrary files to the server, with potential for remote code execu...