CVE-2026-88859

CVE-2026-88859 is a flaw in the Evolution email client where a remote attacker can send a crafted HTML email containing a spoofed vCard control . When the victim clicks it, Evolution's trusted JavaScript handler incorrectly assigns an attacker-controlled JavaScript URL to an iframe's source , res...

CVE-2026-84828

A local privilege escalation and information disclosure flaw in PCS (Pacemaker Configuration System) allows a user with membership in the haclient group to read arbitrary files on the filesystem via the pcs host auth --token command. The pcsd daemon reads file contents with root privileges , and ...

CVE-2026-87962

t-digest versions 3.1 through 3.3 (a Java library for approximate quantile estimation maintained by tdunning on GitHub) contain a denial of service vulnerability in MergingDigest.fromBytes . The root cause is a failure to validate length and capacity fields read from serialized data; a crafted se...

CVE-2026-87961

ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read in the read_ID3_Header function, caused by a shadowed length parameter during ID3 synchronized-lyrics processing. An attacker can craft malicious MP3 files or HTTP audio streams with oversized frame size declarati...

CVE-2026-78085

SP Property is a Joomla extension published by joomshaper.com. A path traversal vulnerability exists in the gallery image management controller, which lacked directory confinement checks, allowing unauthenticated remote attackers to traverse directories. The vulnerability affects versions below 4...

CVE-2026-78302

SP Property (Joomla Extension by joomshaper.com) versions below 4.1.4 are affected by an unauthenticated Stored XSS vulnerability. Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without contextual escaping , allow...

CVE-2026-78374

T4 Page Builder (by joomlart.com) for Joomla, versions prior to 2.3.0 , is vulnerable to an open mail relay via its front-end JSON editor endpoint. The exposed contact action requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled), and has no rate limiting. An at...

CVE-2026-78083

The SP Property Joomla extension (by joomshaper.com) contains a missing CSRF token verification vulnerability affecting versions prior to 4.1.4 . Specifically, the visitor booking endpoint (properties.booking ) and the agent contact form submission endpoint (agents.sendmail ) processed POST reque...

CVE-2026-78084

SP Property (a Joomla extension by joomshaper.com) versions below 4.1.4 contain a Missing Access Control vulnerability in the gallery image management controller. The affected controller tasks lacked authorization checks and CSRF token validation , allowing users to invoke file removal actions wi...

CVE-2026-78082

SP Property is a Joomla extension by joomshaper.com vulnerable to unauthenticated SQL injection in versions prior to 4.1.4 . The root cause lies in the property search and listing query builders, which assembled WHERE and ORDER BY clauses (for zipcode, sorting, price_range_dropdown, and psize_ran...

CVE-2026-78303

SP Property Joomla Extension by joomshaper.com (versions below 4.1.4 ) contains an unvalidated email destination and form manipulation vulnerability in its booking request handling. The root cause is that booking inquiries previously relied on client-submitted hidden fields for recipient email ro...

CVE-2026-87803

CVE-2026-87803 is an authorization bypass in Countly Server DBViewer caused by flawed sub-pipeline detection in the aggregation stage sanitizer at the /o/db endpoint. When the sanitizer encounters an unrecognized key such as the undocumented MongoDB-internal $_internalInhibitOptimization, it misc...

CVE-2026-15889

The Aruba HiSpeed Cache WordPress plugin is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.0.14 , caused by insufficient input sanitization and output escaping in the Post Content field. An authenticated attacker with Contributor-level access o...

CVE-2026-5399

The Redux Framework WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the Slider field in User Profile settings in versions up to and including 4.5.13.1 . The root cause involves three factors: insufficient input sanitization in the user_meta_save() function (which only sani...

CVE-2026-42808

A buffer overflow vulnerability in Bosch Sensortec COINES_SDK versions 2.0 through 2.11 affects the host streaming API function coines_read_stream_sensor_data() . The root cause is that the internal stream processor, comm_intf_process_stream_response() , discards the requested sample count and co...

CVE-2026-42807

A heap-based buffer overflow in the PC bridge protocol decoder (bridge_decoder.c) of BoschSensortec COINES_SDK (versions 2.10–2.12.2) allows a malicious or compromised USB or BLE peripheral to trigger denial of service (process crash) or potentially arbitrary code execution . The root cause is th...

CVE-2026-42806

An out-of-bounds read vulnerability exists in the Bosch BME690 SensorAPI C-driver (v1.0.3 and prior) within the read_all_field_data function (bme69x.c). The driver prefetches heater configuration registers into a 30-byte stack buffer, but the gas_index field is extracted with a 4-bit mask (0–15) ...

CVE-2026-42805

CVE-2026-42805 is a stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI (C library), specifically in the bhi385_parse_debug_message function within bhi385_parse.c. The root cause is that an 8-bit message length field is read directly from an attacker-controlled event payload and u...

CVE-2026-87009

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-88265

crun (a container runtime) is affected by a flaw where, after pivot_root , reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, allowing the container to change that file's ownership (chown). This effectively permits a host bind-mount write and chown from ...

CVE-2026-42804

A stack-based buffer overflow exists in the Bosch Sensortec BHI360 SensorAPI (C-Library) , affecting versions up to and including commit d6b200416a. The flaw is in bhi360_parse_debug_message() (bhi360_parse.c, lines 1852–1875), where the first payload byte of a debug frame is used as a length and...

CVE-2026-8323

An open redirect vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (versions before Version 2 ) allows an attacker to redirect users to an untrusted site, thereby faking the source of data . The CNA-assigned CVSS 3.1 score is 9.3 (CRITICAL) with vector CVSS:3.1/AV:N/...

CVE-2026-82791

This CVE is currently in reserved status with no public technical details available beyond a JVN sighting reference. Monitor for updates once the details are publicized.

CVE-2026-82792

CVE-2026-82792 has been reserved with no public technical details yet. A sighting link to a JVN advisory exists, but no component, root cause, or impact is provided. Action: monitor for updates as details are expected upon publication.

CVE-2026-82793

This CVE candidate is reserved and lacks public technical details in the provided documents. The only related source is a JVN sighting. Monitor for updates once the organization publishes details.

CVE-2026-82790

CVE-2026-82790 is currently reserved with no publicly available technical details in the provided documents. A JVN sighting exists but does not disclose specifics. Monitor for updates as details are expected to be published when the vulnerability is announced.

CVE-2026-82786

CVE-2026-82786 has been reserved and no technical details (affected product, root cause, or impact) are publicly available in the provided documents. A sighting on the JVN feed has been recorded. Action: monitor for updates as the reserving organization publishes the vulnerability.

CVE-2026-82784

Technical details for CVE-2026-82784 have not yet been publicized. The entry is in a reserved state, with only a JVN sighting recorded. Monitor for updates when the candidate is announced.

CVE-2026-82783

This CVE has been reserved but no technical details are publicly available in the provided documents. A sighting referencing a JVN advisory exists, but product, impact, and remediation details remain unpublished. Monitor for updates.

CVE-2026-82782

CVE-2026-82782 is a reserved candidate with no public technical details yet. A JVN sighting is noted, but no product, component, or impact information is available in the provided documents. Monitor for updates as the disclosing organization publicizes the issue.

CVE-2026-82781

This CVE is currently in a reserved state, meaning an organization or individual has claimed the identifier but has not yet publicized details. No concrete information about the affected product, root cause, or impact is available. Monitor for updates.

CVE-2026-82780

This CVE entry is reserved with no public technical details available in the provided documents. A linked JVN advisory (JVNVU96551518) is referenced. Monitor for further updates once details are published.

CVE-2026-82778

Technical details for CVE-2026-82778 are not yet publicly available; it remains a reserved candidate. A sighting reference to JVN (Japan Vulnerability Notes) has been recorded. Action: monitor for updates as the disclosing organization publishes details.

CVE-2026-82779

CVE-2026-82779 is a reserved candidate with no public technical details yet. A JVN sighting exists, but the affected product, root cause, and impact are not disclosed. Monitor for updates as the reserving organization announces the vulnerability.

CVE-2026-82777

Technical details for CVE-2026-82777 are not yet publicly available; the entry is currently reserved pending announcement. A sighting was observed via JVN , but no product, impact, or fix information has been published. Monitor for updates.

CVE-2026-82788

This CVE has been reserved but not yet publicized. A sighting on JVN indicates an associated advisory exists, but no concrete technical details (product, root cause, impact) are provided in the current documents. Monitor for updates.

CVE-2026-82776

This CVE candidate is currently reserved with no public technical details available. A sighting from JVN (Japan Vulnerability Notes) confirms it is being tracked, but the affected product, root cause, and impact are not yet disclosed. Monitor for updates.

CVE-2026-82775

CVE-2026-82775 is currently reserved; no technical details are publicly available in the provided documents. The only connected record is a CIRCL sighting referencing a JVN source. Monitor for updates when the candidate is publicized.

CVE-2026-82774

Technical details for CVE-2026-82774 are not yet publicly available; the candidate remains in reserved status. A sighting references JVN (JVNVU96551518), but no concrete product, cause, or impact is provided. Monitor for updates.

CVE-2026-82773

The CVE entry for CVE-2026-82773 is currently a reserved candidate with no public technical details available in the provided documents. A sighting at JVN has been recorded, but no product, component, or impact information is yet disclosed. Action: monitor for updates.

CVE-2026-82785

This CVE has been reserved and no concrete technical details (affected product, root cause, or impact) are publicly available yet. A JVN sighting was recorded on 2026-09-10. Monitor for further updates.

CVE-2026-82789

Technical details for CVE-2026-82789 are not yet publicly available; the entry is currently reserved. A sighting from JVN (Japan Vulnerability Notes) has been recorded. Action: monitor for updates as details are published.

CVE-2026-82787

CVE-2026-82787 is a reserved candidate with no publicly available technical details. A JVN sighting exists, but no product, impact, or fix information has been published yet. Action: monitor for vendor disclosure.

CVE-2026-82762

CVE-2026-82762 is currently a reserved candidate with no public technical details. A sighting from JVN (JVNVU99009004) confirms an announcement is pending. Monitor for updates as details are expected once publicized.

CVE-2026-82772

CVE-2026-82772 is currently a reserved placeholder with no publicly disclosed technical details. A sighting from JVN (Japan Vulnerability Notes) has been recorded, but no product, component, or impact information is available yet. Monitor for updates.

CVE-2026-82770

CVE-2026-82770 is currently in a reserved state with no publicly available technical details. The only known reference is a JVN (Japan Vulnerability Notes) listing. Action: monitor for updates as the candidate is published.

CVE-2026-82767

CVE-2026-82767 is currently a reserved candidate with no public technical details. A sighting has been logged via JVN (Japan Vulnerability Notes), indicating an associated advisory exists, but no affected product, root cause, or impact is yet disclosed. Action: monitor for updates as details are ...

CVE-2026-82768

CVE-2026-82768 is currently a reserved candidate with no public technical details provided. A sighting referencing JVN exists, but no affected product, root cause, or impact is yet disclosed. Monitor for updates as the entry is published.

CVE-2026-82771

CVE-2026-82771 is currently a reserved candidate with no public technical details yet. A sighting on the Japan Vulnerability Notes (JVN) indicates it is being tracked, but affected products, root cause, and impact are not provided. Action: monitor for updates as details are published.

CVE-2026-82769

CVE-2026-82769 is currently in reserved status with no publicly available technical details. A JVN sighting exists, but the affected product, root cause, and impact are not yet disclosed. Monitor for updates as details are expected upon public announcement.