CVE-2026-73588

Dell Secure Connect Gateway (SCG) Policy Manager , versions prior to 5.34.00.16 , is susceptible to a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access can exploit this flaw to gain unauthorized access . Remediation is available via the sec...

CVE-2026-73587

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 are affected by an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could exploit this flaw to cause Information disclosure , Information tampering , and a Protecti...

CVE-2026-96611

FFmpeg versions before 9.0 are vulnerable to a signed integer overflow in libavformat/mov.c. When processing a crafted HEIF file, the mov_read_ispe() function stores uint32_t width and height values into signed integer fields without bounds checking, causing values exceeding INT_MAX to become neg...

CVE-2026-88974

The WPGraphQL plugin (prior to version 2.22.2 ) contains an authorization bypass in the updatePost mutation within src/Mutation/PostObjectUpdate.php. The root cause is that the mutation only validates the collection-level edit_posts capability and post authorship, failing to enforce object-level ...

CVE-2026-73586

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 are susceptible to an Insufficient Session Expiration vulnerability. A low privileged attacker with adjacent network access could exploit this flaw to achieve Elevation of privileges , Protection mechanism bypass , and ...

CVE-2026-63000

The REDAXO PHP-based content management system is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 5.21.2 . The rex_api_install_package_update function in redaxo/src/addons/install/lib/api/api_package_update.php fails to override the requiresCsrfProtection() method, w...

CVE-2026-96609

Robur Albatross versions 1.0.0 through 2.x before 2.7.2 are vulnerable to a memory exhaustion denial of service. The albatross-console component fails to properly terminate when looping over its internal ring buffer (default 1024 lines). A user with permissions to send console subscription comman...

CVE-2026-62998

The REDAXO PHP-based content management system is vulnerable to an unauthorized ORDER BY identifier injection in versions prior to 5.21.2 . The root cause is located in rex_list::getSortColumn() within redaxo/src/core/lib/list.php, which fails to verify if a requested column was registered via se...

CVE-2026-63002

The REDAXO PHP-based content management system is vulnerable to Stored Cross-Site Scripting (XSS) in the Mediapool Sync page (sync.php). The root cause is the lack of rex_escape() on the $diffFiles variable, which renders filenames from the /media/ filesystem directly into the HTML. An attacker w...

CVE-2026-71178

The Dell Secure Connect Gateway (SCG) Policy Manager , versions prior to 5.34.00.16 , is vulnerable to an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this flaw to gain Unauthorized access . No s...

CVE-2026-63001

REDAXO CMS (prior to version 5.21.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to an unescaped media manager type name in the mediaIsInUse() handler. Located in redaxo/src/addons/media_manager/lib/media_manager.php, the system fails to use rex_escape() when constructing an HTML anch...

CVE-2026-71177

Dell Secure Connect Gateway (SCG) Policy Manager , versions prior to 5.34.00.16 , is vulnerable to an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could exploit this flaw to achieve Elevation of privileges and Session theft . Rem...

CVE-2026-61834

The scim-patch library, used for applying SCIM patch operations, is vulnerable to process-global mutation in versions prior to 0.9.2 . The root cause lies in the navigate() function reading inherited properties and the assign() function using prototype-chain membership checks when resolving attac...

CVE-2026-61413

The Dell Secure Connect Gateway (SCG) Policy Manager contains an Improper Privilege Management vulnerability in versions prior to 5.34.00.16 . A low privileged attacker with remote access could exploit this flaw to gain Unauthorized access . No specific root cause, exploit details, or remediation...

CVE-2026-18179

The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to an issue where a remote attacker can clear active chat sessions. This is caused by improper authorization (CWE-862). The vulnerability impacts versions 4.0.6.0 - 4.0.6.0 iFix6 Refresh (Operator 4.4.6+20260807.081800...

CVE-2026-59167

The SunEditor WYSIWYG editor is vulnerable to a critical XSS vulnerability in versions <= 2.47.10 (specifically confirmed in v2.47.10). The root cause is a sanitizer bypass in src/lib/core.js where the logic fails to consistently reject namespaced or custom HTML elements (e.g., ). This allows ...

CVE-2026-18177

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a security flaw where a remote attacker can execute unauthorized payment actions . The root cause is missing authorization checks (CWE-862), which could lead to high integrity impact and low availability impact. This vu...

CVE-2026-86678

ZohoCorp ManageEngine Applications Manager versions 182000 and below are vulnerable to a broken authentication flaw. This vulnerability allows a low-privileged user to obtain an administrator’s API key , which can then be leveraged to perform administrator-level actions . Exploitation details and...

CVE-2026-86677

ZohoCorp ManageEngine Applications Manager (versions 182000 and below) is vulnerable to a Broken Authentication issue caused by the improper neutralization of special elements in an SQL command . This flaw allows a low-privileged user to execute unauthorized SQL commands, which could lead to admi...

CVE-2026-96560

LightLLM versions through 1.2.0 are vulnerable to remote code execution (RCE) due to a flaw in the KV-transfer worker . When the service is started with the --pd_trans_mode nccl flag, it exposes an unauthenticated RPyC control channel . This channel is susceptible to the deserialization of untrus...

CVE-2026-86679

ZohoCorp ManageEngine Applications Manager (versions 182000 and below ) is susceptible to a permissions validation issue . This vulnerability allows a low-privileged user to delete service monitors that are outside of their assigned scope. The documents do not provide specific details regarding t...

CVE-2026-12974

A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW) . This issue affects versions 7.1.0 through 7.1.13 , 7.3.0 through 7.3.1 , 7.3.3 , 7.4.0 through 7.4.1 , and 7.5.0 . While the CVE is associated with Improper Validation of Specified Quantity in Input , specific te...

CVE-2026-86683

ZohoCorp ManageEngine Applications Manager versions 182000 and below are vulnerable to a Broken Authentication issue. This flaw allows a low-privileged user to unauthorizedly modify the proxy settings . The vulnerability carries a CVSS v3.1 score of 8.1 (HIGH) , with potential impacts on confiden...

CVE-2026-96543

An out-of-bounds heap write flaw exists in the GIMP PVR image loader . When processing a crafted non-square PVR texture, the pvr_decode_twiddle() function fails to perform bounds-checking on the destination offset, allowing attacker-controlled pixel data to be written beyond the allocated heap bu...

CVE-2026-96512

A flaw exists in sudo where time-based access restrictions (NOTBEFORE or NOTAFTER ) that omit the trailing 'Z' timezone indicator rely on the TZ environment variable inherited from the user. Because sudo is a setuid-root program, an unprivileged local user can manipulate the TZ variable to shift ...

CVE-2026-86681

ZohoCorp ManageEngine Applications Manager versions 182200 and below are affected by a permissions validation issue (Broken Access Control). This vulnerability allows low-privileged users to execute administrator-configured MBean actions on monitors that are outside of their assigned scope. No sp...

CVE-2026-86708

ZohoCorp ManageEngine Applications Manager versions 182200 and below are vulnerable to the exposure of a Google Cloud service-account private key within the Applications Manager installer. This sensitive data exposure allows an unauthenticated attacker to impersonate the service account, potentia...

CVE-2026-95676

The WatchGuard AuthPoint Gateway is susceptible to a missing/improper authentication vulnerability within its LDAP Sync first-factor authentication mechanism. Under non-default operating conditions, a remote attacker can bypass single-factor password verification. However, the impact is limited a...

CVE-2026-19599

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below are vulnerable to a Remote Code Execution (RCE) vulnerability located in the Notification Profile module . The root cause is identified as the Improper Neutralization of Special Elements used in an OS Command . This vulnerability cou...

CVE-2026-75825

ZohoCorp ManageEngine OpManager versions 12.8.710 and below are affected by an Authentication Bypass vulnerability when the Application Manager Plugin is enabled. Exploitation of this flaw could allow an attacker to bypass security controls. No specific root cause, exploit details, or remediation...

CVE-2026-86247

A race condition within a thread in Apache Tomcat Native allows client certificate verification requirements to be down-graded for certain configurations. This vulnerability affects versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 , with unsupported versions potentially impacted. To remediat...

CVE-2026-76978

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below are susceptible to a Command Injection vulnerability within the Diagnose Settings feature. Successful exploitation could allow an attacker to execute arbitrary commands on the affected system. Exploitation details a...

CVE-2026-86246

Apache Tomcat Native (versions 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15) is vulnerable to an insecure default configuration where several risky OpenSSL options are enabled by default. These options include ALLOW_CLIENT_RENEGOTIATION , NO_EXTENDED_MASTER_SECRET , IGNORE_UNEXPECTED_EOF , and AL...

CVE-2026-86243

A buffer over-read vulnerability exists in Apache Tomcat Native during the TLS handshake , which can allow a malicious user to trigger a Denial of Service (DoS) by causing a JVM crash . This vulnerability affects versions 1.3.0 through 1.3.8 and 2.0.0 through 2.0.15 , though earlier unsupported v...

CVE-2026-76979

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below are susceptible to an XML Injection vulnerability within the Rule Tracking Compare Policies feature. The vulnerability allows for High confidentiality impact as per the CVSS 3.1 score of 7.7. No specific exploit det...

CVE-2026-84091

The SUMIT Payment Gateway for WooCommerce WordPress plugin (versions before 4.0.0 ) is vulnerable to an Unauthenticated Payment Confirmation Forgery . The root cause is a failure to verify payment notifications with the payment provider before marking orders as paid. This allows unauthenticated u...

CVE-2026-76980

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below are affected by a Data Exposure vulnerability within the Firewall Analyzer syslog collector . This vulnerability allows for high confidentiality impact from an adjacent network vector with low attack complexity and ...

CVE-2026-77112

A Server-Side Request Forgery (SSRF) vulnerability exists in the Weoll platform developed by Global IT Informatics Technology Services Inc. This flaw allows an attacker to perform SSRF attacks, which can lead to JWT Token Disclosure . The vulnerability affects versions before 3.2.45.44 . No speci...

CVE-2026-84787

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below are vulnerable to a Privilege Escalation vulnerability. An authenticated low-privilege user can gain Administrator privileges by exploiting the Report Profile import functionality. The vulnerability carries a base s...

CVE-2026-84789

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below are affected by a Broken Access Control vulnerability. This flaw allows an authenticated low-privilege user to create alert notifications for firewalls that are outside of their assigned scope. The vulnerability has...

CVE-2026-84791

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below are affected by a Broken Access Control vulnerability. This flaw allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls that are outside of their assigned...

CVE-2026-80444

Abis Technology Ltd. Co. AVESİS is vulnerable to an open redirect vulnerability caused by Input Data Manipulation . This flaw allows an attacker to redirect users to an untrusted site. The issue specifically affects versions from 202608201331 before 202608240351 . Exploitation details are not pro...

CVE-2026-78253

A denial of service (DoS) vulnerability exists in the Qt Group Qt framework due to uncontrolled recursion within the QXmlStreamReader::readElementText() function. An attacker can exploit this flaw by providing a specially crafted XML document , which triggers a recursive loop leading to stack exh...

CVE-2026-15358

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions prior to 12.8.671 are susceptible to an unauthorized Path Traversal vulnerability. This flaw allows for unauthorized access to restricted file system paths. Specific exploitation details and links are not provided in the d...

CVE-2026-87022

Apache Tomcat is vulnerable to WebSocket message smuggling due to an improper handling of length parameter inconsistency when the per-message-deflate feature is enabled. This vulnerability affects versions 11.0.0-M1 through 11.0.25 , 10.1.0-M1 through 10.1.59 , and 9.0.0.M1 through 9.0.121 . Addi...

CVE-2026-86350

Apache Tomcat is vulnerable to an HTTP Request/Response smuggling vulnerability caused by a regression in the fix for CVE-2026-41293 . This issue results in an inconsistent interpretation of HTTP/2 requests , which can trigger a request header mix-up . The vulnerability affects versions 11.0.22 t...

CVE-2026-86248

Apache Tomcat is vulnerable to a flaw where CLIENT_CERT authentication does not fail as expected in specific scenarios even when soft fail is disabled. This was caused by an incomplete fix for CVE-2026-34500 , where OCSP checks sometimes soft-fail with FFM. This issue affects versions 11.0.0-M14 ...

CVE-2026-14913

ZohoCorp ManageEngine OpManager and Firewall Analyzer (versions 12.8.669 and below) are vulnerable to an SQL Injection vulnerability within Rule Management Search Reports . This flaw occurs due to the improper neutralization of special elements used in an SQL command. Exploitation details are not...

CVE-2026-79677

A concurrency bug in Apache Tomcat allows an attacker to trigger a denial of service (DoS) by causing lost timeouts during asynchronous WebSocket writes . This vulnerability affects the following versions: 11.0.0-M1 through 11.0.25 , 10.1.0-M1 through 10.1.59 , and 9.0.0.M1 through 9.0.121 . Addi...

CVE-2026-78437

A malformed HTTP/2 request can trigger a denial of service (DoS) in Apache Tomcat due to an incomplete cleanup vulnerability. Depending on the timing, this flaw may cause one user's request to fail. Affected versions include 11.0.19 through 11.0.25 , 10.1.53 through 10.1.59 , and 9.0.116 through ...