CVE-2026-5047

Technical details about this CVE are not publicly available in the provided documents. Monitor for updates.

CVE-2026-63652

Technical details for CVE-2026-63652 are not publicly available in the provided documents. Connected items reference fixes in freerdp-3.30.0-1.1 for openSUSE Tumbleweed, but do not describe this CVE's specifics. Monitor for updates.

CVE-2026-5769

Summary: A vulnerability in Brocade SANnav prior to 3.0.1 may expose admin passwords in plaintext within the memory swap file on the server hosting the SANnav VM during Out Of Memory (OOM) events. This could allow an authenticated admin with server access to view passwords stored in the swap file...

CVE-2026-65094

CVE-2026-65094 is addressed by NVIDIA’s security bulletin for NVIDIA Networking Bluefield, ConnectX. The issue affects VIRTIO-Net and allows a VM user to cause a Write-What-Where condition via a crafted message, potentially leading to code execution in Virtio-Net scope . Affected product family: ...

CVE-2026-51266

CVE-2026-51266 is rejected/not used and does not represent an active vulnerability entry.

CVE-2026-51270

The CVE-2026-51270 records a heap-based buffer overflow in the ESP32- AudioI2S 3.4.5 component’s htmlToUTF8() HTML entity decoding function. An attacker-controlled HTML entity can trigger a heap out-of-bounds write via memmove/memcpy without validating remaining buffer size, potentially enabling ...

CVE-2026-51251

CVE-2026-51251 has concrete details in connected sources: ESP32-audioI2S 3.4.5 contains a buffer overflow in the MP3Decoder::decode() function of the MP3 decoder, caused by missing size validation on untrusted mainDataBegin and nSlots values. This vulnerability is specific to that component/versi...

CVE-2026-63117

Technical details for CVE-2026-63117 are not publicly available in the provided documents. Connected records mention freerdp fixes in openSUSE but do not map to this CVE. Monitor for updates.

CVE-2026-5048

Technical details for CVE-2026-5048 are not provided in the supplied documents. No affected products, impact, or mitigations are disclosed. Monitor for updates.

CVE-2026-5049

Brocade SANnav Zone Alias Import flow is affected by a path traversal vulnerability in versions before 3.0.0a. The root cause is unsanitized multipart filenames, allowing a local authenticated attacker to write uploaded content outside the intended directory. No remediation details are provided i...

CVE-2026-51275

The CVE-2026-51275 record is supported by connected sources indicating a concrete issue in schreibfaul1 ESP32-audioI2S 3.4.5. The vulnerability is a heap-based buffer overflow in the ID3v2 APIC frame parsing within audiolib, caused by missing length validation of the APIC frame size. This leads t...

CVE-2026-51269

This CVE-2026-51269 entry is rejected/not used and does not represent an active vulnerability.

CVE-2026-51274

The CVE-2026-51274 entry relates to the schreibfaul1 ESP32-audioI2S 3.4.5 stack, where the heap-based buffer overflow occurs in the ID3v2 SYLT synchronized lyrics parser in audiolib. Root cause: missing bounds validation on attacker-controlled frame size and improper memory access during lyric pa...

CVE-2026-65448

CVE-2026-65448 affects the WordPress plugin Anti Spam and list cleaner — AcyChecker, specifically versions

CVE-2026-65447

CVE-2026-65447 concerns an unauthenticated cross-site scripting (XSS) vulnerability in the WordPress plugin Contest Gallery , affecting versions up to 30.0.6 . The root cause is an XSS flaw that can be triggered without authentication, with CVSS v3.1 metrics indicating a base score of 7.1 (HIGH),...

CVE-2026-65446

CVE-2026-65446 affects the WordPress Kali Forms plugin up to version 2.4.18, with an unauthenticated Cross Site Scripting (XSS) vulnerability reported. The connected documents specify an XSS flaw in Kali Forms

CVE-2026-65443

CVE-2026-65443 corresponds to an unauthenticated Cross Site Scripting (XSS) vulnerability in the BackWPup WordPress plugin, affecting versions up to 5.7.4. The NVD entry and related records confirm the issue and CVSS v3.1 base score of 7.1 (HIGH) with network attack vector, low attack complexity,...

CVE-2026-65445

The CVE-2026-65445 entry concerns the WordPress Ad Invalid Click Protector (AICP) plugin and its

CVE-2026-65442

The CVE-2026-65442 entry concerns the WordPress FormCraft plugin up to version 3.9.15 with an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. Documentation from multiple sources confirms the affected product (FormCraft) and the vulnerability class (SSRF) but does not provide roo...

CVE-2026-65440

GetGenie WordPress plugin

CVE-2026-65441

CVE-2026-65441 affects WordPress plugin GiveWP up to version 4.16.3, with an Unauthenticated Cross-Site Scripting (XSS) vulnerability. Descriptions in connected documents indicate the issue is present in GiveWP

CVE-2026-65439

The CVE-2026-65439 entry describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “Ultimate Addons for Contact Form 7” affecting versions

CVE-2026-65438

CVE-2026-65438 affects the WordPress plugin “Message Filter for Contact Form 7” (versions up to 1.6.3.9). The issue is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the plugin’s message filtering functionality. No root cause details are provided beyond the XSS description in the ...

CVE-2026-65437

CVE-2026-65437 describes an unauthenticated XSS in the WordPress plugin Spam protection, AntiSpam, FireWall by CleanTalk, affected through versions <= 6.82. The issue impacts users via cross-site scripting without authentication; CVSS 3.1 base score 7.1 (HIGH) with network attack vector, low i...

CVE-2026-61957

CVE-2026-61957 affects the WordPress plugin Miniorange OTP Verification (versions

CVE-2026-61953

CVE-2026-61953 affects the WordPress plugin Simple Link Directory Pro

CVE-2026-66473

The vulnerability CVE-2026-66473 affects the WordPress Xendit Payment plugin, versions up to and including 7.1.0. It is described as Unauthenticated Broken Access Control, indicating that unauthenticated users may access restricted functionality or data within the plugin. The available sources id...

CVE-2026-53669

CVE-2026-53669 (React Router) affects React Router versions 6.0.0 through 7.17.0. The vulnerability is an Open Redirect caused by using backslashes in and useNavigate, permitting unexpected external navigations. This is a follow-up to CVE-2025-68470. The issue is fixed in version 7.18.0. If expl...

CVE-2026-55685

React Router CVE-2026-55685 affects versions 7.0.0–7.17.0, where the manifest endpoint could be accessed by unauthenticated targeted requests, causing heavy load and slower responses. The issue does not impact Declarative Mode or Data Mode applications and has been fixed in version 7.18.0. If exp...

CVE-2026-53668

CVE-2026-53668 affects React Router in versions 6.30.2–6.30.4 and 7.9.6–7.12.0, where open redirects can be abused to trigger XSS via malicious links or redirects to external sites. The issue is addressed in version 7.13.0. Affected users should upgrade to 7.13.0+ (or apply vendor-provided fixes)...

CVE-2026-59240

The CVE-2026-59240 vulnerability is an IDOR in Prospero Flow CRM. Affected code path: DeleteNotificationController::delete() at GET /notification/delete/{id}. It allows any authenticated user to delete notifications belonging to any user because the target record is fetched with Notification::fin...

CVE-2026-53667

CVE-2026-53667 affects React Router (versions 7.11.0–7.17.0) where the RSCErrorHandler failed to validate protocol, enabling possible cross-site scripting via redirects from untrusted sources when using the unstable RSC APIs. The issue stems from missing protocol validation in the RSCErrorHandler...

CVE-2026-53666

CVE-2026-53666 affects React Router versions 6.4.0 through 7.17.0 where attacker-supplied input could overwrite parts of errors captured during SSR, enabling arbitrary constructor execution on the client and triggering outbound network requests. This requires specific, unlikely application-layer ...

CVE-2026-66825

Pivotick exposes a Cross-Site Scripting vulnerability in the sidebar property-list component. Link-like properties (url, uri, href, link, website, homepage) were rendered as hyperlinks without validating their URL scheme, allowing attacker-controlled javascript: values (including obfuscated varia...

CVE-2026-43757

CVE-2026-43757 is an out-of-bounds read issue addressed by improved bounds checking. It affects macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6, where an app may cause unexpected system termination. The fix is in the listed OS versions (Sequoia/Sonoma/Tahoe). No exploitation detai...

CVE-2026-43782

CVE-2026-43782 affects macOS: Sequoia 15.7.8, Sonoma 14.8.8, Tahoe 26.6. The issue was mitigated by improved checks; an app may have accessed sensitive user data. Remediations are in the fixed OS updates cited by NVD/NCSC/CVE records. No exploit details are provided in the sources. Monitor for fu...

CVE-2026-64737

CVE-2026-64737 is an authorization/sandbox issue affecting macOS; Apple lists fixes in macOS Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.6, with a malicious app potentially breaking out of its sandbox. Connected advisories (NCSC 2026-0267) reiterate sandbox isolation improvements, memory/validati...

CVE-2026-43805

CVE-2026-43805 is a race-condition vulnerability in Apple OS components addressed by updates. Affected products include iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, and watchOS 26.6. Root cause: improved state handling to fix a race condition that could enable an ...

CVE-2026-39873

CVE-2026-39873 affects macOS where an issue with memory handling during SMB server interactions could cause system termination. The vulnerability is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Connected advisories describe this as part of broader memory-management fi...

CVE-2026-64776

The CVE-2026-64776 issue affects macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The underlying problem is insufficient bounds checks that may allow an unprivileged app to disclose kernel memory. The advisory details indicate improved bounds checks as the fix and lists the affect...

CVE-2026-64721

CVE-2026-64721 concerns an Apple platform state-management issue that may allow an app to access sensitive user data. The issue is fixed in: iOS/iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. Connected advisories corroborate s...

CVE-2026-43813

CVE-2026-43813 is a validation issue in Apple’s CloudAttestation component which may allow a malicious app to bypass code signing enforcement. The vulnerability is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. The underlying issue relates to inpu...

CVE-2026-20672

CVE-2026-20672 describes an information-disclosure vulnerability in macOS where an app may access sensitive user data. Publicly provided details indicate the issue affects macOS releases Sequoia 15.7.8 and Sonoma 14.8.8 (and related Apple OS updates) and was addressed through privacy-control impr...

CVE-2026-64740

CVE-2026-64740 affects Apple operating systems and pertains to a parsing issue in handling directory paths that could allow a malicious app to break out of its sandbox. The vulnerability is addressed by path validation improvements and is fixed in the following releases: iOS 26.6 and iPadOS 26.6;...

CVE-2026-64691

CVE-2026-64691 is a macOS Tahoe 26.6 fix for a buffer overflow resolved by improved size validation. The issue could cause an unexpected system termination if triggered. Affected product: macOS Tahoe (and related Apple OS updates). Remediation: update to macOS Tahoe 26.6 or later; description and...

CVE-2026-43673

CVE-2026-43673 is an Apple memory‑handling issue. When processing a maliciously crafted audio file, CoreAudio may corrupt process memory. The entry is currently fixed in multiple Apple platforms and versions: iOS 26.6 and iPadOS 26.6; macOS Sequoia 15.7.8; macOS Sonoma 14.8.8; macOS Tahoe 26.6; t...

CVE-2026-64783

CVE-2026-64783 relates to a use-after-free in WebKit/Safari memory handling. The issue affects Apple platforms where processing malicious web content could crash Safari; vulnerable component is memory management within WebKit-based rendering. Apple indicates fixes are included in Safari 26.6 (and...

CVE-2026-43809

CVE-2026-43809 is an out-of-bounds read vulnerability in macOS components. The available documents indicate the issue is resolved by bounds checking improvements and is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The CVE is rated CRITICAL (CVSSv3.1: 9.8) with an impa...

CVE-2026-43665

CVE-2026-43665 affects macOS via a local-attack path where additional entitlement checks could allow a local attacker to determine the legacy VNC password configured for Screen Sharing. Connected sources specify the root cause as entitlement checks and confirm the fix in macOS Sequoia 15.7.8 and ...

CVE-2026-43777

CVE-2026-43777 affects macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. The issue was addressed by improved input validation, and a remote attacker could potentially cause a denial of service. Affected components/versions are specified in the CVE description; fixes are available i...