CVE-2026-82079

A stack-based buffer overflow in the Nintendo Switch local wireless networking functionality allows an attacker within wireless range to execute arbitrary code via return-oriented programming (ROP) using crafted network traffic. The vulnerability affects Nintendo Switch firmware before 23.0.0 , w...

CVE-2026-84939

CVE-2026-84939 is a path traversal vulnerability in Apache FreeMarker 's template loading mechanism (versions 2.2.0–2.3.34 ). An attacker who can supply a malformed locale identifier while the localized lookup setting is enabled (the default) may cause FreeMarker to load templates outside the int...

CVE-2026-49362

Apache Artemis (versions 2.50.0–2.56.0) and Apache ActiveMQ Artemis (1.0.0–2.44.0) contain a missing authentication flaw in the CORE protocol handler . An unauthenticated remote attacker can send CREATE_QUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS que...

CVE-2026-49363

Apache Artemis (2.50.0–2.56.0) and ActiveMQ Artemis (1.0.0–2.44.0) contain a pre-authentication information disclosure vulnerability in the CORE protocol. The SUBSCRIBE_TOPOLOGY_V2 handler in CoreProtocolManager.LocalChannelHandler.handlePacket() processes topology subscription requests on channe...

CVE-2026-49364

CVE-2026-49364 is a CRITICAL (CVSS 9.1) pre-authentication vulnerability in Apache Artemis (2.50.0–2.56.0) and Apache ActiveMQ Artemis (1.0.0–2.44.0). During the initial cluster connection handshake, a lack of access controls in Artemis and JGroups allows an unauthenticated, network-adjacent atta...

CVE-2026-57822

CVE-2026-57822 is a denial-of-service flaw in Apache Artemis (2.50.0–2.56.0) and Apache ActiveMQ Artemis (1.3.0–2.44.0). When the broker processes message-based management requests on the activemq.management address, the JsonUtil.fromJsonArray() method deserializes CompositeData from Base64-encod...

CVE-2026-57967

Apache Artemis (versions 2.50.0–2.56.0) and Apache ActiveMQ Artemis (1.0.0–2.44.0) are affected by a critical session-hijacking vulnerability in the CORE protocol REATTACH_SESSION handler . The handler performs zero authentication —it looks up the session by name only and calls transferConnection...

CVE-2026-67593

CVE-2026-67593 allows an unauthenticated remote attacker to delete arbitrary durable queues on Apache Artemis (2.50.0–2.56.0) and Apache ActiveMQ Artemis (1.0.0–2.44.0) by crafting a malicious OpenWire RemoveSubscriptionInfo command. The root cause is the processRemoveSubscription() method, which...

CVE-2026-75880

CVE-2026-75880 affects Apache Artemis (2.50.0–2.56.0) and Apache ActiveMQ Artemis (1.0.0–2.44.0). An authenticated client (low privileges) can attach a consumer whose message selector contains crafted wildcard usage. This triggers excessive evaluation during message delivery, occupying a shared b...

CVE-2026-77578

CVE-2026-77578 is an authenticated arbitrary local file read vulnerability in Xibo CMS (affected: = 4.4.4). A user with admin or module-template access can import a crafted XML template containing path traversal sequences (CWE-22) via the /developer/template/import endpoint, then retrieve the ref...

CVE-2026-15019

Direct Download for WooCommerce (WordPress plugin) is vulnerable to directory traversal via the file_id path segment in the top-level include function, affecting all versions up to and including 1.19 . The root cause is that the product ownership check only verifies that some free, virtual, downl...

CVE-2026-14873

The Bulk Password Reset plugin for WordPress is affected in all versions up to and including 1.3.3 by a privilege escalation vulnerability. The plugin fails to properly validate a user's identity before updating account details, allowing an authenticated attacker with subscriber-level access or a...

CVE-2026-76562

The Sidebar Manager Light WordPress plugin (versions up to and including 1.18 ) is vulnerable to unauthenticated stored cross-site scripting (XSS) through the sbm_description parameter, caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary...

CVE-2026-15820

Builderall for WordPress (versions up to and including 3.0.2 ) is vulnerable to an Authenticated Stored Cross-Site Scripting flaw in the Photo Module 'attributes' Setting , caused by insufficient input sanitization and output escaping . An attacker with Contributor-level access or above can injec...

CVE-2026-18594

The Advanced Contact Form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.1.3 . The root cause is improper verification of user authorization, allowing authenticated attackers with custom-level access or above to import forged CSV submission r...

CVE-2026-4657

Easy Google Fonts WordPress plugin (≤ 2.0.4) is vulnerable to an authenticated stored cross-site script via the control_selectors meta field. The plugin registers this field with show_in_rest enabled but omits a sanitize_callback, then outputs the unsanitized value directly into tags on the fron...

CVE-2026-18386

The WP BackItUp Community Edition WordPress plugin (all versions up to and including 2.1.0 ) is vulnerable to directory traversal via the backup_file parameter in its download handler. The root cause is that the basename() normalization only executes when the traversed target path does not exist,...

CVE-2026-15823

The Builderall Cheetah For Wp WordPress plugin (versions ≤ 3.0.2 ) contains a missing authorization flaw in the wp_ajax_ba_cheetah_disable AJAX handler. The disable() function is registered without a capability or nonce check, and the target post ID is read directly from user-controlled $_POST['b...

CVE-2026-15796

The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting in all versions up to and including 3.0.2 , caused by insufficient input sanitization and output escaping in the bg_video_service_url setting. An authenticated attacker with Contributor-level access or higher can inj...

CVE-2026-19584

Velociraptor , a threat hunting and incident response platform, is affected by a VQL injection vulnerability in its notebook backup/restore feature. The daily backup mechanism is enabled by default; upon restore, notebook cell content is interpolated into a template without ACL checks . A user wi...

CVE-2026-19583

CVE-2026-19583 is a permission bypass in Velociraptor (an endpoint forensics and EDR tool by Velocidex). Sensitive artifacts such as Linux.Sys.BashShell require the EXECVE permission to schedule, enabling arbitrary command execution on endpoints. However, no equivalent permission check was enforc...

CVE-2026-87870

The Ninja Forms – Scheduled Exports plugin for WordPress (all versions up to and including 3.0.3 ) is vulnerable to Stored Cross-Site Scripting via unsanitized REST API parameters (interval , format , emailTo ). The root cause is insufficient input sanitization and output escaping, compounded by ...

CVE-2026-84063

BurgerEditor versions 3.2.0 through 3.4.0 are affected by an unrestricted file upload flaw allowing a dangerous file type to be uploaded by any authenticated user. Successful exploitation may lead to arbitrary PHP code execution on the server. The CNA-assigned CVSS 4.0 score is 8.5 (HIGH) , with ...

CVE-2026-84062

BurgerEditor (a web content management product by D-zero) versions 3.0.0 through 3.4.0 are affected by an authorization bypass caused by a user-controlled key. An attacker with low-level authentication (existing user account) can exploit this over the network to alter page content , resulting in ...

CVE-2026-18351

The Drag and Drop File Upload for Elementor Forms WordPress plugin is vulnerable to an unauthenticated arbitrary file upload in versions up to and including 1.6.0 . The root cause lies in the is_file_type_valid() function, which uses the attacker-controlled type parameter as regex keys within the...

CVE-2026-87933

CVE-2026-87933 is a use-after-free vulnerability in DaveGamble cJSON (versions up to 1.7.19 ), located in the function cJSONUtils_MergePatch within cJSON_Utils.c. The flaw can be triggered remotely with low complexity and no required privileges, yielding low impacts on confidentiality, integrity,...

CVE-2025-71416

CVE-2025-71416 affects the TrendAI Apex One Security Agent , specifically its cache mechanism , where a Time-Of-Check Time-Of-Use (TOCTOU) flaw enables local privilege escalation . The vulnerability arises when the cache mechanism performs a check at one point but uses the resource at a different...

CVE-2026-52098

Flowise 3.1.2 (an open-source flow-based LLM application builder) is vulnerable to remote code execution via the /api/v1/prediction/ endpoint, requiring no authentication. The CVSS 3.1 score is 9.8 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N. CISA's SSVC assessment rates exploitation as none ...

CVE-2026-38626

Garlic-Hub v1.0.1 is vulnerable to SQL Injection in the file src/Modules/Items/Repositories/ItemsRepository.php, as identified in a researcher report published on GitHub. The vulnerability type and affected component are confirmed, but no CVSS metrics, exploit status, or remediation guidance are ...

CVE-2022-26962

Italtel NFV 11.1.2-20210318 contains a Multiple Stored XSS vulnerability in the NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp page (specifically via the operation=list&object=announcementAS query). The vulnerable parameters are name , username , and mrfAnnouncementName . A malicious authentic...

CVE-2026-79592

An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 , caused by insufficient validation of file-controlled OLE summary offsets. The CVSS 3.1 score is 7.5 (HIGH) with a network attack vector, low complexity, no privileges required, no user interaction, and ...

CVE-2026-71642

CVE-2026-71642 affects ZJU-FAST-Lab EGO-Planner-v2 (a robot motion planning project) in all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 . The vulnerability resides in the EGOReplanFSM::checkCollisionCallback() function and allows an attacker to cause a denial of service . The s...

CVE-2026-79591

A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 , caused by insufficient validation of a file-controlled font index. A potential fix is referenced in a GitHub pull request (libxls PR #164 ), alongside issue #161 . No CVSS metrics or conf...

CVE-2026-71643

CVE-2026-71643 affects ZJU-FAST-Lab EGO-Planner-v2 (a robotic planning system) in all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 . The vulnerability resides in the EGOReplanFSM component and allows an attacker to cause a denial of service . No specific root-cause mechanism or ...

CVE-2026-52097

AppFlowy 0.11.8 is affected by a vulnerability allowing a remote attacker to execute arbitrary code through the afLaunchUri , _afLaunchLocalUri (url_launcher.dart), OpenFilex.open , and localPathRegex (common_patterns.dart) components. The CNA-assigned CVSS 3.1 score is 6.8 (MEDIUM) with a Physic...

CVE-2026-50808

CVE-2026-50808 is a reserved CVE candidate associated with nopCommerce , an e-commerce platform. According to the linked PT Security disclosure, no released version containing a fix is currently available, so users should mitigate until a fix is published . The provided documents do not yet speci...

CVE-2026-85715

CVE-2026-85715 is currently reserved with no public technical details in the provided documents. A connected PT Security entry references it but does not disclose specific affected products, root cause, or impact. Monitor for further updates.

CVE-2026-71645

CVE-2026-71645 affects RACER , a robotics framework developed by the SYSU STAR Group (Robotics-STAR-Lab) . The vulnerable component is the exploration state machine , and the tested affected version is commit abcdef1234567890 . An attacker can trigger a denial of service by exploiting a flaw in t...

CVE-2026-71647

CVE-2026-71647 affects EGO-Planner-v2 (by ZJU-FAST-Lab), a motion planning tool for autonomous vehicles. All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 are vulnerable to denial of service via the checkCollisionCallback, execFSMCallback, and planFromGlobalTraj functions in ego_...

CVE-2026-71640

ZJU-FAST-Lab EGO-Planner-v2 , an autonomous driving motion planning system, is affected by improper handling of expired trajectory data in its replanning pipeline across all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42. The flaw can result in unsafe vehicle motion , as stale tra...

CVE-2025-57231

Docmost v0.21.0 contains a Path Traversal vulnerability in avatar attachments , allowing an unauthenticated attacker to disclose local files by sending a POST request to a public URL. The CVSS 3.1 score is 7.5 (HIGH) with impact limited to confidentiality (no integrity or availability impact). Th...

CVE-2026-79590

A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0 . An attacker can supply a specially crafted Ruby source file that causes the parser to pass a NULL pointer to nonnull string handling functions, leading to undefined behavior and an application crash . A...

CVE-2025-71415

CVE-2025-71415 affects TrendAI Apex One Security Agent , where a Time-Of-Check Time-Of-Use (TOCTOU) flaw in the cache mechanism allows a local privilege escalation. An attacker with local access could potentially exploit the race condition between the cache check and its use to elevate privileges...

CVE-2026-36392

FairSketch Rise CRM (RISE – Ultimate Project Manager & CRM) versions ≤ 3.9.6 are affected by a stored XSS in the item title field. An authenticated administrator can inject arbitrary JavaScript into an item's title; the payload is stored server-side and executes in the browser of any client user ...

CVE-2026-68006

Puma (a Ruby application server) versions v.5.0.0 through before v.8.0.3 are affected by an issue in the ext/puma_http11/http11_parser.rl file that allows an attacker to execute arbitrary code . The fix is to upgrade to v.8.0.3 or later. No exploitation status or active in-the-wild usage is provi...

CVE-2026-74780

CVE-2026-74780 is a privilege escalation vulnerability in Windows ALPC (Alternate Local Procedure Call) that allows a low-privilege attacker to reach SYSTEM level. It is one of two actively exploited zero-days patched in the September 2026 Patch Tuesday and is listed on CISA's Known Exploited Vul...

CVE-2025-71414

CVE-2025-71414 affects TrendAI Apex One , a Trend Micro endpoint detection and response product. The vulnerability stems from an incomplete cleanup issue that enables local privilege escalation . The initial CVE entry is still in a reserved state, but the connected PTSecurity report (PT-2026-8948...

CVE-2026-65388

CVE-2026-65388 is part of a security release in apple/container 1.3.1 , adopted by Berthly 1.3.1 . The release addresses this CVE along with five additional advisories, some in code Berthly links directly. A notable behavior change introduced is that authenticated plain-HTTP registries now requir...

CVE-2026-59179

CVE-2026-59179 is a Path Traversal (CWE-22) vulnerability in @openhop/server 0.3.5 (openhop CLI 0.3.6). The FlowStore.filePath() method passes unsanitized HTTP route parameters directly to path.join(), allowing an unauthenticated attacker to read or delete arbitrary .yaml files outside the config...

CVE-2026-59177

ESPHome Device Builder (the Home Assistant add-on) contained an authentication bypass in its dashboard ingress site. The site was intentionally unauthenticated—relying on the Home Assistant supervisor to authenticate upstream—but was incorrectly bound to 0.0.0.0. Because the add-on runs in host n...