CVE-2026-78341

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Unauthorized access...

CVE-2026-78340

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code executio...

CVE-2026-71884 Packet CTR reports a full success length after the counter is exhausted

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space the IV left. In CTR mode the IV and the block counter share one 16-byte block, so an IV of 13 to 15 bytes leaves a counter of only 1 to 3 byte...

CVE-2026-78339

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Protection...

CVE-2026-78027

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery SSRF vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Server-side request forgery...

CVE-2026-78026

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-62049 WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1...

CVE-2026-78025

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism...

CVE-2026-78024

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Server-Side Request Forgery SSRF vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Protection mechanism bypass,...

CVE-2026-78023

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-107935 Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...

CVE-2026-78022

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely 'Failing Open' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass...

CVE-2026-107655

A flaw was found in CUPS. When processing embedded job ticket comments within documents, the service improperly handles specific IPP attributes, causing an unhandled null pointer dereference. An unauthenticated attacker permitted to submit jobs to a shared printer queue can send a crafted Interne...

CVE-2026-78021

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and...

CVE-2026-78020

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Remote...

CVE-2026-78019

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges, Filesyst...

CVE-2026-78018

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-104935

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-78017

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Protection...

CVE-2026-78016

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Validation of Specified Type of Input vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure and Information...

CVE-2026-78015

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Use of Less Trusted Source vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tampering...

CVE-2026-78013

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resource with an Insecure Default vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service, Information...

CVE-2026-76779

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges,...

CVE-2026-104635

Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash the decoding process via a deeply nested JSON document. Any application that decodes attacker-supplied JSON with Protobuf.JSON.decode/3,...

CVE-2026-76769

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-84220

The Kirki WordPress plugin before 6.3.2 does not prevent shortcodes held in comments from being executed when it renders them, and displays comments regardless of their moderation status, allowing unauthenticated visitors to run shortcodes registered on the site and to read private custom fields ...

CVE-2026-84224

The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the respons...

CVE-2026-97075

Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rocket: from n/a before 3.23.5...

CVE-2026-4264

The BeeTienda eCommerce platform (specifically the latest demo version ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the lack of proper sanitization of user input in the 'search' parameter of the product list endpoint. Malicious payloads sent via this parameter are r...

CVE-2025-14123

The Redux Framework plugin for WordPress (versions up to and including 4.5.11 ) is vulnerable to privilege escalation . The root cause is the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist restrictions. This allows authentica...

CVE-2026-98384

The Linux kernel contains an out-of-bounds read vulnerability in the bpf subsystem within the bpf_sock_destroy() function. The issue arises because the code attempts to read sk_protocol from a sock structure; however, for timewait or request sockets handed to the function by the tcp iterator, thi...

CVE-2026-98383

The Linux kernel contains a vulnerability where an LWT_SEG6LOCAL program can invalidate its cached SRH using bpf_lwt_seg6_adjust_srh() and subsequently call bpf_skb_pull_data(). This sequence can cause skb-&gt;head to be reallocated, resulting in a dangling per-CPU SRH pointer . Subsequent post-p...

CVE-2026-98381

The Linux kernel contains a vulnerability where the veth component fails to properly manage XDP program pointers during a channel resize. Specifically, the function veth_set_channels() tears down XDP resources for removed RX queues but fails to clear rq-&gt;xdp_prog. This allows queues to retain ...

CVE-2026-98382

The Linux kernel contains a vulnerability where bound-only BPF programs can incorrectly match sibling ports due to a fallback mechanism in __bpf_offload_dev_match(). Because these programs typically have NULL offdevs , unrelated netdevs can compare as equal on offload-registered netdevs. An attac...

CVE-2026-98380

A vulnerability exists in the Linux kernel 's net/sched component where tcf_idr_delete_index() fails to properly handle IDR error pointers . Specifically, if an unlocked classifier removes an action and reserves the same IDR slot with ERR_PTR(-EBUSY) between the lookup and deletion, the system tr...

CVE-2026-98379

The Linux kernel contains a vulnerability in the netfilter: ip6t_rpfilter component. The ip6_route_lookup() function can return a route where rt6i_idev is NULL if an external nexthop device's MTU is lowered below IPV6_MIN_MTU, causing the inet6_dev to be torn down while the route remains in the F...

CVE-2026-98378

The Linux kernel contains a vulnerability in the bpf subsystem where the link iterator fails to skip unsettled links. Specifically, bpf_link_prime() inserts a link into link_idr before bpf_link_settle() publishes its ID. While bpf_link_by_id() correctly treats ID-zero links as unsettled, the link...

CVE-2026-98377

The Linux kernel contains a vulnerability in the vlan component where the __vlan_insert_inner_tag() helper function fails to verify the presence of a MAC header before rewriting the first 16 bytes. Specifically, on IFF_TUN devices with hard_header_len == 0, the system may accept a one-byte AF_PAC...

CVE-2026-98376

The Linux kernel contains a vulnerability in the eBPF subsystem where percpu_array_map_ops.map_meta_equal incorrectly points to bpf_map_meta_equal(). Because the latter fails to compare max_entries, a percpu array used as an inner map can be replaced with a smaller one, bypassing size checks. Thi...

CVE-2026-19575

A type confusion vulnerability exists in the device_deinit() system call within the Zephyr kernel (kernel/device.c ). The verification handler z_vrfy_device_deinit() incorrectly uses K_OBJ_ANY , causing k_object_validate() to skip type comparisons. This allows a user-mode thread to pass an arbitr...

CVE-2026-19569

An integer overflow vulnerability exists in the Zephyr RTOS kernel's dynamic_object_create() function within kernel/userspace/userspace.c. The system fails to check for unsigned wrap-around when computing backing allocations for dynamically allocated kernel objects and thread stack elements. An u...

CVE-2026-19574

The ARM64 MMU back-end in Zephyr (specifically in arch_mem_domain_init()) contains a vulnerability where it assigns Address Space Identifiers (ASIDs) using a round-robin counter. Because only 255 ASIDs exist, wrapping the counter allows a new memory domain to share an ASID with a still-live domai...

CVE-2026-19571

A race condition exists in the ITE IT8xxx2 SHI host-command backend (specifically in ec_host_cmd_backend_shi_ite.c) within the Zephyr RTOS. The vulnerability occurs because the driver copies the 8-byte host-command request header from the SPI Rx FIFO into the shared receive buffer (data-&gt;in_ms...

CVE-2026-19570

The LE Audio Broadcast Sink in the Bluetooth subsystem is vulnerable to an out-of-bounds write because it copies subgroup metadata from a received Basic Audio Announcement (BASE) into the mod_src_param structure without proper bounds checking. Specifically, the base_subgroup_meta_cb() function fa...

CVE-2026-98375

The Linux kernel contains a vulnerability in the xen/netfront component where handle_incoming_queue() fails to verify if the pull_to length is at least ETH_HLEN . This allows a backend to provide a short RX slot, causing eth_type_trans() to either trigger a BUG() in __skb_pull() (if subsequent sl...

CVE-2026-106155

Progress Telerik Report Server prior to version 12.2.26.1007 is vulnerable to a stored cross-site scripting (XSS) flaw in the shared reporting engine. An authenticated report author can embed javascript: or vbscript: URLs within report navigation actions or HTML text box links. If another user vi...

CVE-2026-106145

Progress Telerik Report Server prior to version 12.2.26.1007 is vulnerable to a privilege escalation flaw due to incorrect privilege assignment in the service-agent SignalR hub . An authenticated user, such as a low-privilege or guest account with a valid bearer token, can register as a trusted s...

CVE-2026-101028

The ash-project ash framework (versions 2.6.0 to 3.34.6 ) contains an Incorrect Authorization vulnerability in the Ash.Actions.Aggregate.run/4 function. The root cause is that the aggregate path skips applying read policies for related resources, whereas the standard read path correctly applies t...

CVE-2026-97076

The WP Rocket WordPress plugin is vulnerable to an Executable Regular Expression Error (CWE-624) in versions prior to 3.23.5 . This vulnerability can lead to Code Injection or a Denial of Service (DoS) attack. While the initial description mentions code injection, the PatchStack documentation spe...

CVE-2026-81929

The Ocean Pro Demos (versions up to and including 1.5.4 ) and Ocean eComm Treasure Box (versions up to and including 1.8.0 ) WordPress plugins are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient authorization, input sanitization, and output escaping within the Pop...