CVE-2026-65884

CVE-2026-65884 affects Joomla Extension Gridbox < 2.20.2 by Balbooa. The issue is in the registration method, which allows users with provided usergroup IDs to create new accounts with administrative permissions, enabling unauthenticated account creation with high privileges. Public references...

CVE-2026-65885

CVE-2026-65885 affects Joomla Extension Gridbox

CVE-2026-65442

CVE-2026-65442 is an unauthenticated Server-Side Request Forgery (SSRF) in the WordPress FormCraft plugin (versions ≤ 3.9.15). The root cause is missing nonce verification and authentication checks on the formcraft3_get AJAX endpoint, allowing an unauthenticated attacker to force the server to is...

CVE-2026-63077

CVE-2026-63077 affects JetBrains TeamCity On-Premises: unauthenticated remote code execution via deserialization of untrusted data in the agent polling protocol. Affected are TeamCity versions prior to 2025.11.7 and prior to 2026.1.3. The root cause is deserialization of untrusted data that allow...

CVE-2026-16812

CVE-2026-16812 affects VeloCloud Orchestrator (VCO) On-Prem. The vulnerability is an OS command injection that could allow a remote attacker to access privileged internal functionality and impact the VCO host, compromising confidentiality, integrity, and availability of the orchestrator and manag...

CVE-2026-59553

CVE-2026-59553 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Product Feed Manager plugin, affecting versions ≤ 7.6.1 . The vulnerability was discovered by hhhai and rated CVSS 3.1: 7.1 (HIGH) with a changed scope, requiring user interaction but no authentication....

CVE-2026-15981

CVE-2026-15981 is a critical (CVSS 9.8) unauthenticated authentication bypass in the miniOrange SAML 2.0 Single Sign On – SSO Login WordPress plugin (≤ 5.4.4). The root cause is a loose boolean check in mo_saml_validate_signature(): PHP's openssl_verify() returns -1 on internal error, which evalu...

CVE-2026-16723

CVE-2026-16723 is a remote-code-execution vulnerability in Fastjson 1.2.68–1.2.83 that is exploitable under stock/default configuration without AutoType or a gadget. Connected docs confirm the attack chain can occur in Spring Boot fat‑JAR deployments: an attacker controls the @type value, Fastjso...

CVE-2026-16232

CVE-2026-16232 concerns an authentication bypass in Check Point SmartConsole login. An unauthenticated remote attacker can obtain an application login token and authenticate with full administrative privileges, enabling changes to security policies/configurations. Exploitation requires internet a...

CVE-2026-60137

CVE-2026-60137 (SQL injection in WP_Query::author__not_in) affects WordPress 6.8.x (6.8.0–6.8.5), 6.9.x (6.9.0–6.9.4), and 7.0.x (7.0.0–7.0.1). The vulnerability occurs when author__not_in is passed as a string instead of an array, bypassing sanitisation and allowing unsafe interpolation into an ...

CVE-2026-63030

CVE-2026-63030 is a critical WordPress Core flaw in the REST API batch endpoint that, when combined with CVE-2026-60137, enables unauthenticated SQL injection via the author__not_in path and can lead to Remote Code Execution. Affected releases include WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; fixed ...

CVE-2026-9198

IBM Langflow OSS versions 1.0.0–1.10.0 are affected by an unauthenticated remote code execution (RCE) vulnerability that chains two endpoints: /api/v1/auto_login (which mints a superuser token for callers when AUTO_LOGIN is enabled) and /api/v1/validate/code (which executes user-supplied Python c...

CVE-2026-9586

Sangoma Switchvox SMB Edition 8.3 (104997) is vulnerable to an unauthenticated SQL injection in the /pa endpoint. The endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. A sing...

CVE-2021-27137

CVE-2021-27137 affects DD-WRT’s UPnP service (ssdp.c) before change set 45724, where an unsafe strcpy copies user-supplied data into a fixed 128-byte buffer, enabling a remote unauthenticated attacker to overflow the buffer via M-SEARCH requests on UDP/1900. By default UPnP is off and bound to in...

CVE-2026-15410

CVE-2026-15410 affects SonicWall SMA1000 Appliance Management Console (AMC). It is a post-authentication code-injection vulnerability that, under certain conditions, could allow a remote authenticated administrator to execute arbitrary OS commands. Root cause: improper control of generation of co...

CVE-2026-15409

Summary: CVE-2026-15409 is a Server-Side Request Forgery (SSRF) affecting SonicWall SMA1000 Appliances (Work Place interface). A remote unauthenticated attacker could force the appliance to make requests to unintended locations. The vulnerability is rated CVSS v3.1: 10.0 (CRITICAL) with network a...

CVE-2026-55040

CVE-2026-55040 describes weak authentication in Microsoft Office SharePoint that can allow an unauthenticated, network-based attacker to bypass a security feature and access or tamper data. The CVSS v3.1 vector indicates a network attack with low prerequisite access, no user interaction, and high...

CVE-2026-58644

CVE-2026-58644 – Microsoft SharePoint Deserialization of Untrusted Data (Server) involves a deserialization flaw in SharePoint Server that allows an unauthenticated attacker to execute arbitrary code over a network. The vulnerability affects Microsoft Office SharePoint/SharePoint Server component...

CVE-2026-50522

CVE-2026-50522 is a deserialization flaw in Microsoft Office SharePoint that enables remote code execution over a network. Affected products include on‑premises SharePoint Server variants (Server 2016/2019, Subscription Edition, Enterprise Server). The root cause is deserialization of untrusted d...

CVE-2026-56164

CVE-2026-56164 is a Microsoft SharePoint Server elevation-of-privilege vulnerability described as missing authentication for a critical function, enabling a remote attacker to elevate privileges over a network. Public advisories indicate widespread Office-related vulnerabilities, with SharePoint ...