CVE-2026-77706

The FileOrbis NextGen FileServer (versions before 12.7 ) is vulnerable to a data amplification issue caused by improper handling of highly compressed data. Specifically, processing a maliciously compressed spreadsheet file can lead to a Denial of Service (DoS) condition, described as Sustained Cl...

CVE-2026-92241

In Zephyr RTOS , a deadlock vulnerability exists in the Bluetooth Classic AVRCP browsing channel due to the browsing_avrcp_l2cap_alloc_buf() callback in subsys/bluetooth/host/classic/avrcp.c. The issue arises because the function allocates from the avctp_browsing_rx_pool using K_FOREVER. A connec...

CVE-2026-116411

The Dell PowerStore system is affected by a Server-Side Request Forgery (SSRF) vulnerability. An authenticated user with limited privileges could exploit this flaw to make requests to internal services, potentially resulting in information disclosure . A security update is referenced in the provi...

CVE-2026-91094

A directory traversal bug exists when unpacking 3.0 (quilt) source packages . An attacker can provide a packaging tarball containing a quilt database directory (.pc) with attacker-controlled symlinks . If combined with patches that fail to apply, this vulnerability allows the code responsible for...

CVE-2026-109095

An integer overflow exists in the glamor Xv Image Size handling within X.Org xwayland (before 24.1.15) and X server (before 21.1.26). This flaw can be exploited by authenticated clients to cause a server crash or result in an unintended data leak . Remediation involves updating to patched version...

CVE-2026-82179

Dell PowerStore is subject to an authorization bypass vulnerability. An authenticated administrator can exploit this flaw to bypass multi-approver controls on critical operations. The underlying cause is categorized under CWE-915 (Improperly Controlled Modification of Dynamically-Determined Objec...

CVE-2026-116412

The Dell PowerStore platform is affected by an insecure-file-permissions vulnerability (CWE-732). A local low-privileged attacker could exploit this flaw to disclose administrative credentials . The risk is categorized as MEDIUM with a CVSS 3.1 score of 5.5. Remediation details are referenced in ...

CVE-2026-127125

P-Net versions prior to 1.0.4 are vulnerable to a NULL pointer dereference during the handling of fragmented responses in an RPC session. The issue occurs because the software fails to verify the existence of an Application Relationship before processing a resent response fragment. Specifically, ...

CVE-2026-116413

The Dell PowerStore system is affected by a use-of-broken-cryptography vulnerability (CWE-327). A low-privileged attacker could exploit this flaw to impersonate another identity , which may result in unauthorized access . Detailed information regarding the specific component, version, or remediat...

CVE-2026-127124

P-Net versions prior to 1.0.4 are vulnerable to a denial of service (DoS) condition due to a resource exhaustion flaw in the RPC session pool. The software fails to implement a timeout for RPC sessions allocated to fragments of requests with unknown activity UUIDs, or for sessions lacking an Appl...

CVE-2026-127123

P-Net versions before 1.0.4 are vulnerable to an issue where an RPC session's Application Relationship is released without following the proper abort procedure. This occurs when a request fragment uses a different data representation (such as endianness ) than the initial fragment. The consequenc...

CVE-2026-127122

P-Net versions prior to 1.0.4 are vulnerable to an out-of-bounds write because the software fails to validate the number of MCR request blocks in a Connect request against the allocated capacity (PNET_MAX_MC_CR ). An attacker with ADJACENT network access can provide excessive blocks, causing data...

CVE-2026-124762

P-Net versions prior to 1.0.4 are vulnerable to an Origin Validation Error (CWE-346). The software identifies RPC sessions using only the activity UUID, failing to verify if a received reject, fault, or cancel PDU is a legitimate response or its true source. An attacker with ADJACENT network acce...

CVE-2026-124761

P-Net versions prior to 1.0.4 are vulnerable to an incorrect behavior order where the IP suite of a DCP Set request is saved to non-volatile configuration before the device state is validated. If a request is refused (e.g., due to an active Application Relationship), the configuration is not rest...

CVE-2026-124760

The P-Net software (versions prior to 1.0.4 ) is vulnerable to a flaw where a malformed alarm notification can cause the alarm receiver to stop delivering subsequent notifications of the same priority. The issue occurs because the system sets the receiver state to waiting for confirmation before ...

CVE-2026-124758

P-Net versions before 1.0.4 are vulnerable to an integer underflow within IODWrite requests targeting non-user record indices. The software fails to validate the record data length against the record block header size. When a 32-bit length smaller than the header is processed, it underflows to ap...

CVE-2026-109096

A flaw in the X.Org Server 's XvPutImage length validation allows authenticated X clients to bypass size checks by exploiting incorrect handling of negative returns from ddQueryImageAttributes(). This vulnerability affects X.Org xwayland before version 24.1.15 and X Server before version 21.1.26 ...

CVE-2026-124759

P-Net versions before 1.0.4 are vulnerable to an Origin Validation Error (CWE-346) where the system routes received RTA alarm frames to an Application Relationship based solely on the destination alarm reference. Because the software fails to verify the source address of the frame, an attacker wi...

CVE-2026-125800

The WordPress Spectra plugin (also known as ultimate-addons-for-gutenberg by Brainstorm Force) versions 2.20.5 and below is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The vulnerability is caused by Improper Neutralization of Input During Web Page Generation (CWE-79), which allows an ...

CVE-2026-86353

The Dell PowerStore appliance is vulnerable to a use of a weak cryptographic algorithm (CWE-327). This vulnerability could allow an attacker with existing privileged access to the appliance to recover stored credentials . No specific remediation steps or exploit details are provided in the docume...

CVE-2026-107525

Dell PowerStore is affected by an information disclosure vulnerability. An unauthenticated attacker can exploit this flaw to obtain service metadata , which could be leveraged to facilitate further attacks. A security update is available via Dell's official support documentation (DSA-2026-479). N...

CVE-2026-125801

The Automattic WooCommerce plugin (versions 11.0.0 through 11.2.2 ) is vulnerable to a Race Condition (CWE-362) caused by concurrent execution using a shared resource with improper synchronization. This vulnerability allows for the leveraging of race conditions to impact the application. No speci...

CVE-2026-105880

The Tobias WebinarIgnition WordPress plugin (versions

CVE-2026-112830

The Brizy WordPress plugin (versions

CVE-2026-125816

The MapSVG WordPress plugin (versions

CVE-2026-119518

The WProyal Royal Elementor Addons WordPress plugin (versions

CVE-2026-121721

The PublishPress Gutenberg Blocks (advanced-gutenberg) plugin for WordPress versions up to and including 3.7.6 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the Improper Neutralization of Input During Web Page Generation . This flaw allows an attacker to i...

CVE-2025-41725

The JBL Flip 4 is vulnerable to a Denial of Service (DoS) condition when running firmware versions prior to 4.1.0 . An unauthenticated attacker can cause the device to crash and become unavailable by sending specific malformed Bluetooth messages . The root cause is categorized under CWE-923 (Impr...

CVE-2026-125814

The Product Feed PRO for WooCommerce plugin (woo-product-feed-pro) by Rymera Web Co is vulnerable to a Content Injection (Basic XSS) vulnerability in versions up to and including 13.5.8 . This issue stems from the Improper Neutralization of Script-Related HTML Tags in a Web Page , allowing for po...

CVE-2026-125833

The YITH WooCommerce Ajax Product Filter plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the yith-woocommerce-ajax-navigation component. This issue is caused by Improper Neutralization of Input During Web Page Generation (CWE-79). The vulnerability affec...

CVE-2026-95518

A Time-of-check time-of-use (TOCTOU) race condition vulnerability exists in the Pardus Package Installer developed by TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü. The flaw affects versions from 0.7.0 before 0.7.1 . Attackers can leverage this race condition to achieve high impact con...

CVE-2026-128834

The Spectra WordPress plugin (specifically the ultimate-addons-for-gutenberg by Brainstorm Force) versions 2.20.5 and below is vulnerable to a Missing Authorization vulnerability (CWE-862 ). This flaw allows for the exploitation of incorrectly configured access control security levels. The impact...

CVE-2026-121771

The PublishPress Gutenberg Blocks (advanced-gutenberg) plugin for WordPress is vulnerable to a Sensitive Data Exposure vulnerability (CWE-201) in versions up to and including 3.7.6 . This flaw allows an attacker to retrieve embedded sensitive data that is inserted into sent data. No specific expl...

CVE-2026-107526

Dell PowerStore is affected by an improper input validation vulnerability (CWE-20). An authenticated low-privileged attacker could exploit this flaw to execute stored cross-site scripting (XSS) within the management interface. The documents do not provide specific details regarding the vulnerable...

CVE-2026-125815

The We’re Open! WordPress plugin (versions up to 2.8 ) is vulnerable to a Content Injection flaw, specifically identified as an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) . This vulnerability exists within the opening-hours component and allows for Code Injectio...

CVE-2026-86355

The Dell PowerStore appliance is affected by an External Control of File Name or Path vulnerability (CWE-73 ). A remote authenticated attacker could exploit this flaw to potentially achieve privilege escalation on the appliance. The vulnerability has a CVSS 3.1 score of 8.3 (High) . Remediation d...

CVE-2026-86356

Dell PowerStore is affected by an authorization-bypass vulnerability (CWE-863) that could allow an attacker to achieve elevation of privilege to administrator. This vulnerability has a CVSS v3.1 base score of 8.8 (High) , with a network attack vector and low complexity. No specific exploit code o...

CVE-2026-120221

In FRRouting 8.4 and later , the bgpd daemon is vulnerable to a double free vulnerability when dynamic BGP neighbors disconnect. This occurs if a peer-group used by a "bgp listen range" has a Site-of-Origin (SoO) configured. Because dynamic neighbors share the peer-group's SoO value instead of ma...

CVE-2026-109903

A buffer overread vulnerability exists in the X.Org X Server (prior to version 21.1.26) and xwayland (prior to version 24.1.15) within the XvQueryImageAttributes function. The flaw is caused by casting a negative integer to CARD32 , which allows authenticated X clients to trigger crashes . Remedi...

CVE-2026-128845

A flaw exists in TiMidity++ where an attacker can cause a Denial of Service (DoS) by tricking a user into opening or converting a specially crafted MIDI audio file. The root cause is a stack-based buffer overflow caused by missing bounds checks during the processing of oversized System Exclusive ...

CVE-2026-123274

An Out-of-bounds Write vulnerability exists in Apache DataSketches C++ (versions 2.0.0 through 5.3.0 ). The flaw occurs during the deserialization of a KLL sketch from an untrusted source because the application fails to validate serialized level boundaries. This allows an attacker to provide a c...

CVE-2026-123338

A vulnerability in Apache DataSketches C++ (versions 3.0.0 through 5.3.0) allows for an out-of-bounds write during the deserialization of a REQ sketch from an untrusted source. The root cause is the lack of validation on serialized compactor headers , which can lead to heap memory corruption when...

CVE-2026-109904

A buffer overread in X.Org xwayland and X Server is caused by an integer-overflow in Proc/SProcXResQueryClientIds. This vulnerability affects X.Org xwayland versions before 24.1.15 and X Server versions before 21.1.26 . An authenticated X client can exploit this to crash the server or leak inform...

CVE-2026-125659

The eMudhra emBridge software contains an information disclosure vulnerability due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without validating the requester's authority. An unauthenticated attac...

CVE-2026-112182

OpenKM Community Edition contains an authorization vulnerability within its workflow definition management. The REST endpoints registerProcessDefinition and runProcessDefinition authenticate users but fail to verify roles in the WorkflowService or underlying layers. Consequently, an attacker with...

CVE-2026-112181

The OpenKM Community Edition software is vulnerable to an XML External Entity (XXE) flaw due to inadequate restriction of external references in the FormUtils / LocalEntityResolver component. An authenticated remote attacker with the ROLE_USER role can exploit this via a REST request. In the 6.3....

CVE-2023-54423

OpenMage magento-lts versions before 20.2.0 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is that the TinyMCE WYSIWYG editor fails to adequately filter scripts within specially crafted HTML tags. An attacker can inject an element containing a malicious onmouseover at...

CVE-2024-58405

Zipline through version 3.7.9 is affected by an improper authorization vulnerability in the /api/auth/register endpoint. The flaw occurs because the system only enforces invite codes when user registration is disabled; if both features are enabled, registration succeeds without a required invite....

CVE-2024-58404

Zipline versions from 3.4.5 before 3.7.10 are affected by a path traversal vulnerability in the user data export endpoint . The root cause is a failure to properly validate the name query parameter , allowing authenticated attackers to bypass user ID checks. By using directory traversal sequences...

CVE-2025-71459

The software Zipline through 4.3.2 is vulnerable to a path traversal vulnerability (CWE-22) via the x-zipline-filename header. Authenticated uploaders can supply traversal sequences to write files outside the intended upload directory. An attacker using a local datasource can create or overwrite ...