CVE-2026-15894 Bluetooth Mesh solicitation PDU stack buffer overflow via oversized advertisement

The Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a fixed 17-byte stack buffer without bounding the source length. In solpdudecrypt, out is allocated as NETBUFSIMPLE17 and then filled with...

CVE-2026-19186 Integer underflow in IEEE 802.15.4 frame decryption leads to out-of-bounds read and write

ieee802154decipherdataframe in subsys/net/l2/ieee802154/ieee802154frame.c computed payloadlen = netpktgetlenpkt - llhdrlen - authtaglen without first checking that the received frame is at least llhdrlen + authtaglen bytes long. All three variables are uint8t, so a frame whose payload is shorter...

CVE-2026-103416

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...

CVE-2025-64391

This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it...

CVE-2025-64392

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link...

CVE-2026-93026

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-58068

This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system...

CVE-2026-58069

This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host...

CVE-2025-64393

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server...

CVE-2026-93684 Apache Impala: Stored XSS in Impala query plans

An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS CWE-79. Users are recommended to upgrade to version 4.5.3...

CVE-2026-90466 Apache Impala: Path traversal executes JARs outside trusted paths

Path traversal of 'trustedjarpaths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trustedjarpaths'. The startup flag 'trustedjarpaths' references URIs for loading files from local or remote filesystems. Path...

CVE-2026-97720 Apache Impala: Impala Executor Webserver Auth Bypass

Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token JWT signatures are...

CVE-2026-5703 Path Traversal in Satel Iberia SenNet Datalogger Serie 200

Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the UR...

CVE-2026-89417 OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-107104 Unsafe Deserialization Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted data to the vulnerable functionality of the targeted system. Successf...

CVE-2026-107103 SQL Injection Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An unauthenticated remote attacker could exploit this vulnerability by supplying specially crafted input to the vulnerable endpoint. Successful exploitation o...

CVE-2026-97146

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-107102 Account Takeover Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API endpoint. An unauthenticated remote attacker could exploit this vulnerability by manipulating the parameter to cause the application to establish an...

CVE-2026-92393

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-78243

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-102782 Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic,...

CVE-2026-102781 Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6

Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider 5.4.6 - modOsTouchSliderHelper::getAjax, wired through Joomla’s core comajax dispatcher, is the single handler behind every data-management operation this module exposes. No call to JFactory::getUser,...

CVE-2026-107121

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...

CVE-2026-82212

The Nexi XPay Build WordPress plugin (version 7.6.2 and below ) contains a vulnerability where the payment notification route fails to correctly validate the security token. Specifically, the plugin accepts requests when the target order lacks a stored token. This allows unauthenticated attackers...

CVE-2026-82211

The Nexi XPay Build WordPress plugin through version 7.6.2 is vulnerable to unauthenticated payment completion and order key disclosure. The root cause is a failure to verify the payment result supplied to several unauthenticated routes. This allows an attacker to mark arbitrary orders as paid or...

CVE-2026-105322

The Magee Shortcodes WordPress plugin (version 2.1.1 and below ) contains a vulnerability where it fails to restrict the recipient of certain unauthenticated contact-form actions. This flaw allows unauthenticated users to perform a mail relay attack, sending arbitrary emails to any destination th...

CVE-2026-86833

The MetForm WordPress plugin versions prior to 4.3.1 is vulnerable to unauthenticated HTML injection . The root cause is a failure to sanitize or escape submitted form-field values before they are inserted into the HTML body of notification emails. This allows an unauthenticated attacker to injec...

CVE-2026-97354

The PowerPress Podcasting plugin by Blubrry for WordPress (versions 11.13.12 through 11.17.10 ) is vulnerable to a Server-Side Request Forgery (SSRF) attack. The root cause is a failure to validate the destination of redirects when the plugin fetches a user-supplied media URL. This allows users w...

CVE-2026-97331

The User Private Files WordPress plugin (versions before 2.1.9 ) is vulnerable to an Email Address Disclosure flaw. The root cause is a failure to validate that a supplied user belongs to the specific document being operated on before returning that user's email address. This allows any authentic...

CVE-2026-96530

The Optimole WordPress plugin (versions 4.0.0 - 4.2.14 ) contains a vulnerability where it fails to perform a capability check before exposing stored image-optimization account data within a dashboard widget. This flaw allows any authenticated user, including those with Subscriber privileges, to ...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin (versions 1.4.4 - 1.10.1 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page . An attacker can exploit this...

CVE-2026-97188

The String locator WordPress plugin (versions before 2.6.8 ) is vulnerable to unauthenticated PHP Object Injection via its database editor. The flaw exists because the plugin fails to restrict allowed classes during the deserialization of database row content. An unauthenticated attacker can stor...

CVE-2026-87782

The Koinonia Link WordPress plugin (versions 1.1.2 through 1.1.4 ) is vulnerable to a privilege escalation flaw. The root cause is a failure to verify if a user possesses the necessary permissions to modify roles before saving a role selection during a profile update. This allows any authenticate...

CVE-2026-86816

The WPCafe WordPress plugin (versions prior to 3.0.21 ) contains a vulnerability where certain REST API endpoints lack proper access restrictions. This flaw allows unauthenticated attackers to access and read sensitive WooCommerce product data , specifically including private product meta , per-p...

CVE-2026-105316

The Magee Shortcodes WordPress plugin, in versions up to and including 2.1.1 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to properly sanitize or escape user input within certain AJAX actions (specifically live_preview and magee_create_shortco...

CVE-2026-104678

The CP Media Player WordPress plugin, in versions prior to 1.3.4 , contains a security vulnerability due to a missing capability check on its settings-page handler . This flaw allows users with only Contributor-level access to perform actions that should be restricted to administrators, such as c...

CVE-2026-104953

The MPG WordPress plugin (versions prior to 4.2.3 ) is vulnerable to a SQL injection flaw. The root cause is the failure to properly validate the structure of imported project data before utilizing it in a database query. This allows users with the Editor role or higher to execute SQL injection a...

CVE-2026-104651

The Yaad Sarig Payment Gateway For WC WordPress plugin, in versions before 2.2.13 , contains a vulnerability that allows authenticated users, including those with subscriber privileges, to perform arbitrary order payment manipulation . The root cause is an IDOR (Insecure Direct Object Reference) ...

CVE-2026-104667

The Animated Number Counters WordPress plugin (versions

CVE-2026-104653

The Envira Gallery WordPress plugin versions before 1.16.1 is vulnerable to Stored XSS . The root cause is the failure to sanitize or escape user-supplied gallery display configuration values before they are stored and subsequently output within an image tag attribute . This allows users with the...

CVE-2026-104050

The Academy LMS WordPress plugin, versions prior to 4.0.0 , contains a vulnerability where it fails to verify if a quiz question belongs to a course the requesting user is authorized to access. Specifically, the render_quiz_answers function does not perform this check before returning answer opti...

CVE-2026-104677

The WP Coder WordPress plugin (versions 4.0 to 4.5.1 ) is vulnerable to Remote Code Execution (RCE) . The root cause is that the plugin fails to restrict its PHP code-execution feature to administrators; instead, it is gated by a content capability held by the Editor role by default. This allows ...

CVE-2026-104652

The Envira Gallery WordPress plugin (versions before 1.16.1 ) is vulnerable to a Stored XSS flaw. The root cause is the failure to properly sanitise and escape a gallery item identifier before it is output in an image tag attribute . This allows users with Author roles or higher to inject arbitra...

CVE-2026-103378

The Geliver Akıllı Kargo Pazaryeri WordPress plugin, in versions 3.0.0 through 3.1.0 , contains a vulnerability where it fails to restrict unauthenticated access to a log file stored in a web-accessible directory. The plugin writes the site's carrier integration key into this log while processing...

CVE-2026-103681

The Frontend Dashboard WordPress plugin, in versions prior to 3.0.0 , is vulnerable to an authorization bypass due to a missing capability check in one of its AJAX actions . This flaw allows authenticated users with low-level privileges, such as subscribers , to delete the plugin's configured pro...

CVE-2026-104049

The Academy LMS WordPress plugin (versions before 4.0.0 ) is vulnerable to arbitrary lesson content disclosure via a REST API route. The root cause is a failure to verify course enrollment or object ownership when returning lesson content. This allows users with a self-registerable student accoun...

CVE-2026-103323

The Integration for Epos Now and WooCommerce WordPress plugin (versions before 4.11.2 ) contains an authorization bypass on a REST endpoint. This vulnerability allows unauthenticated users to retrieve scheduled background tasks and their arguments. Impacted data includes order identifiers and, if...

CVE-2026-103870

A path traversal flaw exists in pulp-rpm during the distribution tree publication process. The software uses addon and variant IDs from .treeinfo files as directory names without sufficient validation. An attacker with permissions to sync or upload a distribution tree can force the publish task t...

CVE-2026-103869

A flaw exists in pulp-ansible regarding the bearer-token refresh mechanism for collection remotes. The application incorrectly stores the access token in a module-level variable , causing it to be reused for every token download within a worker. An attacker capable of syncing an Ansible remote wi...

CVE-2026-103868

A flaw in pulp-container allows for the reuse of registry credentials across different remotes within the same worker during authentication to an upstream registry. Specifically, Basic and bearer credentials from one remote are incorrectly reused for subsequent downloads. An attacker who can sync...