CVE-2026-101028

Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 lib/ash/actions/aggregate.ex applied only the root resource's read policy before running the...

CVE-2026-97076

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5...

CVE-2025-14123

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-81929

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the...

CVE-2026-93548

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in tha...

CVE-2026-106097

The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network tho...

CVE-2026-106095

The Code Snippets WordPress plugin before 3.10.0 does not perform a capability check on one of its snippet-management actions and derives the network scope of the targeted snippet from the request instead of from the stored record, allowing an administrator of a single subsite on a multisite...

CVE-2026-87841

The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthenticated attackers to mark orders placed through it as paid without any payment being made, as well as to force other orders into a failed state...

CVE-2025-15700

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly...

CVE-2026-92989

The SendPress Newsletters WordPress plugin through 1.26.1.20 does not check the user's capability on several newsletter-management actions, allowing any authenticated subscriber-level user to synchronise all site users into a mailing list and to drive the newsletter send queue...

CVE-2026-92990

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses...

CVE-2026-86850

The SKU Error Fixer for WooCommerce WordPress plugin through 1.0 does not perform any capability or nonce checks on two of its AJAX actions, which are also available to unauthenticated users, allowing them to permanently delete product variations it classifies as obsolete, and to disclose those...

CVE-2026-88931

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

CVE-2026-87109

An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organizatio...

CVE-2026-87108

An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, including host and configuration...

CVE-2026-87110

An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting. This can temporarily slow other traffic served by the same process while requests continue...

CVE-2026-107914

Backdrop CMS versions 1.34 (before 1.34.5) and 1.35 (before 1.35.1) fail to sufficiently protect configuration exports when delivering a compressed archive. This vulnerability, categorized under CWE-497 , allows for the exposure of sensitive system information. The risk is partially mitigated bec...

CVE-2026-107911

A type confusion vulnerability exists in the _read_flags function (src/commands/cmd_dispatcher.c) of FalkorDB before version 4.20.0 . A remote authenticated attacker capable of running GRAPH.QUERY can trigger the flaw because the system accepts a --bolt argument and casts a Redis string object to...

CVE-2026-107910

FalkorDB versions before 4.20.0 are vulnerable to an authentication bypass in the is_authenticated function (src/bolt/bolt_api.c ) of the Bolt endpoint. The root cause is fail-open error handling during an empty AUTH command sent to Redis; the system only mandates a password upon receiving a WRON...

CVE-2026-107909

FalkorDB versions before 4.20.0 are vulnerable to a pre-authentication heap out-of-bounds write in the ws_read_frame and buffer_apply_mask functions. This occurs because WebSocket frames with a 64-bit extended payload length are not properly bounded; the existing check is an ASSERT() that is omit...

CVE-2026-107908

FalkorDB versions prior to 4.20.0 are vulnerable to a heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c). The flaw occurs because the handler uses ASSERT() to validate the chunk size, which is omitted in release builds. This allows a remote unauthenticated attack...

CVE-2026-107889

A stored Cross-Site Scripting (XSS) vulnerability exists in the login theme rendering component of Keycloak . The flaw arises because the security filter intended to sanitize user input can be bypassed, enabling a realm administrator to inject malicious scripts into display fields. If exploited, ...

CVE-2026-107890

OpenPrinting CUPS versions before 2.4.20 are vulnerable to a NULL pointer dereference during job-creation requests. The issue arises when repeated IPP group tags cause the parser to create unnamed separator attributes with IPP_TAG_ZERO . The add_job() function incorrectly converts these to IPP_TA...

CVE-2026-107888

OpenPrinting CUPS versions before 2.4.20 are vulnerable to a NULL pointer dereference in the cupsdCheckJobs() function. The issue occurs when a job marked job-held-on-create refers to a temporary printer that has been automatically deleted. Because cleanup removes the destination without cancelin...

CVE-2026-7826

FalkorDB versions prior to 4.18.4 are vulnerable to a heap-based out-of-bounds read in the BufferSerializerIOv2_ReadBuffer function (located in src/serializers/serializer_io.c). The root cause is a missing bounds check; while an ASSERT() exists, it is compiled out in release builds, allowing memc...

CVE-2026-7827

FalkorDB versions prior to 4.18.4 are vulnerable to a stack-based buffer overflow in the _RdbLoadEntity function of the RDB graph decoders (located in src/serializers/decoders/*/decode_graph_entities.c). The root cause is an unbounded property count in a crafted RDB stream, where the count sizes ...

CVE-2026-5759

FalkorDB versions before 4.18.1 are vulnerable to a double free and use-after-free flaw in the RdbLoadDeletedNodes function within the RDB graph decoders (src/serializers/decoders/*/decode_graph_entities.c ). The root cause is a length check relying on ASSERT() , which is removed in release build...

CVE-2026-107886

OpenPrinting CUPS versions prior to 2.4.20 are vulnerable to a double-free vulnerability in the printer-class management component. The issue occurs because add_class() frees pclass->printers without clearing the pointer; if subsequent validation fails, the class retains a dangling pointer tha...

CVE-2026-107885

OpenPrinting CUPS through version 2.4.20 is vulnerable to a resource-exhaustion vulnerability in the cupsdCheckJobs() function. The scheduler incorrectly suppresses timeout processing for all pending jobs if any client connection has an in-flight Send-Document operation, regardless of whether tha...

CVE-2026-93886

The IBM i operating system (versions 7.3, 7.4, 7.5, and 7.6 with license program product 5770-SS1 ) is vulnerable to CVE-2026-93886 . An authenticated remote attacker can execute arbitrary script code due to improper validation of user-supplied input within the HTTP Server Administration Graphica...

CVE-2026-97032

HTTP/2 servers are vulnerable to a crash caused by a race condition in the HPACK encoder . The issue occurs because the server modifies the encoder from two goroutines without proper synchronization: one goroutine encodes a HEADERS frame for a client response, while another modifies the encoder's...

CVE-2026-78669

The net/http component is vulnerable to excessive CPU consumption due to how it handles HTTP/2 connections. A malicious peer can exploit this by opening a large number of streams and repeatedly sending small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. The documents do not prov...

CVE-2026-78667

The net/http package is vulnerable to a CPU exhaustion issue when parsing a Range header that contains a large number of small ranges. Specifically, the functions FileServer(FS) , ServeContent , and ServeFile(FS) can consume an excessive amount of CPU resources during this process. No specific re...

CVE-2026-78660

The net/http package in the Go programming language contains a vulnerability where the HTTP/2 implementation allows malformed framing-related headers. While these headers do not interfere with HTTP/2 framing, they can be forwarded to an HTTP/1 client when the implementation acts as a reverse prox...

CVE-2026-94439

The net/http package in Go is vulnerable to a connection desynchronization issue when an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request without hijacking the connection. Because a 2xx response converts the connection into a tunnel, the server should cease treating the conne...

CVE-2026-78663

The Go net/http package's HTTP/2 server is vulnerable to a double refund of connection-level flow control. Specifically, the server may refund data twice for the same data: first when a client resets a stream (refunding sent-but-unread portions) and again when a request handler reads the buffered...

CVE-2026-94440

A memory limit bypass vulnerability exists in the net/textproto and mime/multipart packages. When parsing a multipart form , an attacker can cause the system to read an arbitrarily long line into memory if the remaining limit at the start of a part is less than 400 bytes. This occurs due to an in...

CVE-2026-56857

On Windows , the os package functions Root.Mkdir and Root.MkdirAll are vulnerable to a directory traversal-like behavior. When the target path ends in a junction pointing to an empty location (e.g., path/to/junction), the operation can create a directory at the junction target even if it resides ...

CVE-2026-78659

The net/http package in Go is vulnerable to a memory exhaustion attack when handling HTTP/2 requests. A malicious client can send "Trailer" headers with a large number of fields, causing the server to allocate a disproportionate amount of memory to populate the Request.Trailer map . This exploit ...

CVE-2026-56866

The net/http package's http.Transport is vulnerable to connection desynchronization when sending an HTTP/1 CONNECT request with a non-empty Request.Body . The transport writes the body directly without framing after the headers; if the server rejects the request with a non-2xx keep-alive response...

CVE-2026-97031

The crypto/tls component is vulnerable to a memory exhaustion attack because it previously failed to reject multiple ECH outer extension references , which are prohibited under RFC 9849. An attacker could send a well-crafted packet with multiple references to trigger a memory amplification vector...

CVE-2026-97030

The html/template package in Go is affected by an issue where the 'yield' keyword, when used as a regexp preceder keyword, might not be correctly escaped in templates authored by a trusted source. The vulnerability arises from inconsistent escaping logic for valid versus non-keyword uses. Remedia...

CVE-2026-94448

The html/template package in Go is vulnerable because the context tracking state was not properly reset when a JavaScript template literal contained consecutive expressions. This flaw prevents subsequent regular expression literals from being accurately recognized and escaped. The fix ensures tha...

CVE-2026-94447

The golang.org/toolchain component in cmd/go is vulnerable to a checksum database bypass. A user operating within a malicious Go project can define a bogus go.sum entry and utilize a malicious GOMODPROXY to bypass intended checksums. To remediate this, the toolchain is updated to ensure it always...

CVE-2026-94444

The Go toolchain (specifically cmd/go ) is vulnerable to a checksum bypass regarding the golang.org/fips140 module. A user operating within a malicious Go project that defines a bogus golang.org/fips140 dependency and utilizes a malicious GOMODPROXY could serve an arbitrary module in its place. T...

CVE-2026-107802

SumatraPDF (version 3.6.1 and earlier) is vulnerable to Windows command-line argument injection within its AI selection-translate feature. The issue resides in src/SelectionTranslate.cpp, where the functions BuildGrokTranslateCmdLineTemp(), BuildClaudeTranslateCmdLineTemp(), and BuildCodexTransla...

CVE-2026-107738

SumatraPDF versions 3.6.1 and earlier on Windows are vulnerable to an out-of-bounds read. The issue resides in the ChmFile::GetCharZ() function, which narrows file-controlled unsigned string offsets from /#WINDOWS and /#IVB to signed integers without performing a lower-bound check. If an offset b...

CVE-2026-107737

The multi-format reader SumatraPDF for Windows is vulnerable to an out-of-bounds object lookup in versions 3.6.1 and earlier , and in pre-release 3.7.0.20369 when WebView2 is absent or fails to initialize. The root cause lies in the ParseProtoUrl() function, which accepts the signed host componen...

CVE-2026-107736

SumatraPDF (version 3.6.1 and earlier) on Windows is vulnerable to a stack buffer overflow during the processing of EXIF Orientation metadata. The issue resides in the MaybeFlipBitmap() function, which uses GDI+ to read an attacker-controlled PropertyTagOrientation size via GetPropertyItem() into...

CVE-2026-107735

The multi-format reader SumatraPDF (version 3.6.1 and earlier) on Windows contains a fail-open policy initialization flaw in the InitializePolicies() function. The application initializes the sumatrapdfrestrict.ini path with gPolicyRestrictions set to Perm::All and only performs bitwise OR operat...