CVE-2026-77616: Improper Neutralization of Input During Web Page Generation

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an...

CVE-2026-84084: Cross-Site Request Forgery (CSRF)

IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to a cross-site request forgery CSRF vulnerability...

CVE-2026-88825: Improper Neutralization of Input During Web Page Generation

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and ...

CVE-2026-81181: Session Fixation

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes does not rotate the session identifier after successful authentication, allowing session fixation. An attacker who can obtain an unauthenticated SysReptor...

CVE-2026-91142: Out-of-bounds Write

A flaw was found in Cockpit. An integer overflow vulnerability in the dolastlog function, specifically in the offset calculation for lastlog entries on ILP32 Integer, Long, Pointer 32-bit builds, can be exploited. A low-privileged authenticated user with a specially provisioned large User ID UID...

CVE-2026-61548: Stack-based Buffer Overflow

Rsyslog is a rocket-fast system for log processing. From 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSDPARAM function in plugins/mmpstrucdata/mmpstrucdata.c stores RFC5424 parameter values in a fixed pVal32 1024 stack buffer and calls parsePARAMVALUE without supplying the...

CVE-2026-93313: Integer Overflow or Wraparound

A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted element is the function JBIG2Stream::readCodeTableSeg of the file poppler/JBIG2Stream.cc. Performing a manipulation results in integer overflow. The attack can be initiated remotely. The exploit has been made public and could ...

CVE-2026-17262: Improper Neutralization of Special Elements used in an OS Command

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP authentication commands...

CVE-2023-5778: Improper Handling of Length Parameter Inconsistency

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Controller AC700, ABB Freelance Controller AC800, and ABB Freelance Controller AC900. This issue affects Freelance Controller DCP: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, and 201...

CVE-2026-93432: Improper Neutralization of Input During Web Page Generation

A flaw was found in the Quarkus Qute template engine. When the eval section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability...

CVE-2026-89278: Exposure of Sensitive Information to an Unauthorized Actor

The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.34.6 via the enqueuefrontendscripts. This makes it possible for unauthenticated attackers to...

CVE-2026-75157: Incorrect Authorization

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with READ instead of EDIT. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-triggered scheduling for it — a state-changing...

CVE-2026-89059: Improper Handling of Highly Compressed Data (Data Amplification)

A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very larg...

CVE-2026-89330: Improper Neutralization of Input During Web Page Generation

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...

CVE-2026-61720: Integer Underflow (Wrap or Wraparound)

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser computes the DMOD modulator count as chunk.size / SFMODSIZE - 1 without rejecting chunks smaller than one record. A crafted SF2 file containing a zero-sized DMOD chunk makes the...

CVE-2026-25684: Improper Input Validation

A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...

CVE-2026-93873: Cross-Site Request Forgery (CSRF)

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Attackers can auto-submit contact forms from attacker-controlled pages to send forged messages attributed to authenticated victims to the administrator inbox...

CVE-2025-14754: Improper Neutralization of Special Elements used in an OS Command

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...

CVE-2026-93596: Missing Authorization

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine = 26.8.1 fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker threads used by the parallel edge-connect phase of POST /api/v1/batch/database. Because those workers have no current user,...

CVE-2026-93687: Uncontrolled Recursion

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError...

CVE-2026-92708: Exposure of Sensitive Information to an Unauthorized Actor

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-6205: External Control of File Name or Path

An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks...

CVE-2026-81178: Incorrect Authorization

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and...

CVE-2026-77386: URL Redirection to Untrusted Site

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and...

CVE-2026-84070: Improper Neutralization of Input During Web Page Generation

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of input during web page generation...

CVE-2026-77568: Exposure of Sensitive Information to an Unauthorized Actor

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-2026-15747. Notes: All CVE users should reference CVE-2026-15747 instead of this candidate...

CVE-2026-93308: Allocation of Resources Without Limits or Throttling

A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be...

CVE-2026-88994: Improper Control of Filename for Include/Require Statement in PHP Program

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that is included at render time, allowing users with contributor-level access and above to include arbitrary local files, disclose their contents, and execute PH...

CVE-2026-56595: Permissive Cross-domain Policy with Untrusted Domains

HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and...

CVE-2026-93468: Relative Path Traversal

The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files...

CVE-2026-77608: Improper Neutralization of Input During Web Page Generation

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

CVE-2021-48008: Improper Neutralization of Special Elements used in an SQL Command

Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipulating the siteid GET parameter in the webservice endpoint. Attackers can exploit the lack of input sanitization or parameterization through UNION-based...

CVE-2026-93606: Protection Mechanism Failure

vm2 npm versions 3.12.0 and earlier contain a sandbox escape in VM and NodeVM. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js only wra...

CVE-2026-62279: Authorization Bypass Through User-Controlled Key

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-controlled recordIds to the DuplicateRecordsToOtherVehicles endpoint while naming destination vehicleIds the user could edit. The endpoint...

CVE-2026-63635: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid colormode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled...

CVE-2026-61821: Missing Authorization

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, droppartitionid and droppartitiontime use partconfig.retentionschema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partmanuser access can select a target...

CVE-2026-28199: Improper Verification of Cryptographic Signature

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential...

CVE-2026-54147: Use of a Broken or Risky Cryptographic Algorithm

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefor...

Red Hat: CVE-2026-46655: virtio-win: viosock.sys: integer overflow in VIOSockSelect leads to heap-based buffer overflow

virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTLSELECT request with attacker-controlled VIRTIOVSOCKSELECT.Fdss.fdcount values that overflow the 32-bit sum used by VIOSockSelect...

CVE-2026-93658: Improper Preservation of Permissions

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with...

CVE-2026-93559: Missing Authentication for Critical Function

A vulnerability was identified in Forget-C Jellyfish AI Short Drama Studio 0.1.0-alpha/0.2.0/0.3.0/0.3.1/0.3.2. This affects an unknown function of the file backend/app/dependencies.py of the component FastAPI. The manipulation leads to missing authentication. It is possible to initiate the attac...

CVE-2026-59956: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.20.0, 3.1.15.0, and 3.2.0.3-beta1, An uncompressed 16-bit iff image with a z-buffer makes iffinput::readimg allocate a temporary scanline from...

CVE-2026-81627: Out-of-bounds Write

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset DLCK protection and injecting code...

CVE-2026-64847: Allocation of Resources Without Limits or Throttling

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three...

CVE-2026-93602: Improper Check for Certificate Revocation

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

CVE-2026-93311: Integer Overflow or Wraparound

A vulnerability was detected in Freedesktop Poppler 26.07.0. This issue affects the function SampledFunction::SampledFunction of the file poppler/Function.cc of the component SampledFunction. The manipulation of the argument BitsPerSample results in integer overflow. The attack may be performed...

CVE-2025-33141: Exposure of Sensitive System Information to an Unauthorized Control Sphere

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment...

CVE-2026-91707: Missing Authorization

The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2026-57229: Improper Initialization

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's...

CVE-2026-93561: Undefined Security Weakness

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...