CVE-2026-66322 Microsoft Edge (Chromium-based) Spoofing Vulnerability

...

CVE-2026-66311 Microsoft Edge (Chromium-based) Tampering Vulnerability

...

CVE-2026-65802 Microsoft Edge for Android Information Disclosure Vulnerability

...

CVE-2026-65804 Microsoft Edge (Chromium-based) Spoofing Vulnerability

...

CVE-2026-66316 Microsoft Edge (Chromium-based) Spoofing Vulnerability

...

CVE-2026-66315 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

...

CVE-2026-66314 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

...

CVE-2026-66313 Microsoft Edge (Chromium-based) Tampering Vulnerability

...

CVE-2026-66310 Microsoft Edge for Android Information Disclosure Vulnerability

...

CVE-2026-66312 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

...

CVE-2026-66321 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

...

CVE-2026-66318 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

...

CVE-2026-18684 GL.iNet GL-MT3000 modem.so glc remove_profile command injection

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. This issue affects the function removeprofile of the file /cgi-bin/glc of the component modem.so. This manipulation causes command injection. It is possible to initiate the attack remotely. The exploit has been made available to the...

CVE-2026-48323 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation o...

CVE-2026-48333 Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)

Adobe Campaign Classic ACC is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain elevated privileges. Exploitation of this issue does not require user interaction...

CVE-2026-48317 Adobe Campaign Classic (ACC) | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code 'Eval Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-48331 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Campaign Classic ACC is affected by a Server-Side Request Forgery SSRF vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed...

CVE-2026-48330 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL...

CVE-2026-48399 Adobe Campaign Classic (ACC) | Violation of Secure Design Principles (CWE-657)

Adobe Campaign Classic ACC is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require...

CVE-2026-48326 Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

Adobe Campaign Classic ACC is affected by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute...

CVE-2026-18667 Sensor Proxy Version 1.4.2 Fixes One Vulnerability

A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host...

CVE-2026-46714 Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation

Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4...

CVE-2026-47746 Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature validation and the compaction process. Because the JSON-LD parsing context is not shared between signature verification and...

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

CVE-2026-67616 Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint

Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create draft posts by bypassing role and permission checks. Attackers can send requests to the drafts endpoint using only...

CVE-2026-46713 Misskey: JSON-LD signature validation + compaction may lead to improper activity handling

Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation and compaction process that allows spoofed activities to be accepted as valid. This issue has been fixed in version 2026.5.4...

CVE-2026-18682 OpenAkita File Upload API upload cross site scripting

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

CVE-2026-46712 Misskey: Lack of proper permission checks in Direct Messaging feature

Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages formerly Chat feature, regardless of account permissions...

CVE-2026-69249 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an...

CVE-2026-48115 Misskey: Improper Authorization in the Announcements API

Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data that they...

CVE-2026-69248 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com, python-cryptography's verifier...

CVE-2026-10849 Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in responsejsoncb subsys/mgmt/hawkbit/hawkbit.c. The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the...

CVE-2026-69247 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

CVE-2026-69246 Guzzle: Noncanonical host can bypass host-based checks

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host header separately. The cURL handlers set CURLOPTURL to the URI exactly as written and push that Host into CURLOPTHTTPHEADER; StreamHandler does the same throu...

CVE-2026-48113 Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection

Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against...

CVE-2026-69245 Guzzle: Noncanonical cookie domain keeps subdomain scope

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

CVE-2026-18648 Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...

CVE-2026-41447 FirmaCheck < 1.3.16 DLL Hijacking via Unvalidated OpenSSL Configuration Path

FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files x86\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration...

CVE-2026-48063 Baileys has message upsert / hist sync spoofing and app state corruption when using maliciously crafted protocolMessage payload

Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to...

CVE-2026-18738 Shlink CSV Formula Injection via Visit Export CLI

Shlink versions 5.0.0 through 5.1.5 contain a CSV formula injection vulnerability that allows unauthenticated remote attackers to plant spreadsheet formulas into exported visit data by supplying malicious values in User-Agent, Referer, or request path headers beginning with formula-triggering...

CVE-2026-69244 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigg...

CVE-2026-48061 Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header

Litestar is an Asynchronous Server Gateway Interface ASGI framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the...

CVE-2026-69243 AIOHTTP: HTTP request smuggling via WebSocket upgrade

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability...

CVE-2026-18647 jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue affects the function isValidTLD of the file /backend/functions/src/cloud-functions/crawler.ts of the component Crawler/Puppeteer. The manipulation leads to server-side request...

CVE-2026-18737 Shlink Blind SQL Injection via tags/stats orderBy Parameter

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing...

CVE-2026-49132 OPNsense < 26.1.9 Stored XSS via Certificate Description Field

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...

CVE-2026-18733 Prompt injection bypasses shell tool consent gate in Strands Agents Tools

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...

CVE-2026-18646 danpros HTMLy Author Name htmly.php path traversal

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has...

CVE-2026-49131 OPNsense < 26.1.9 Stored XSS via Firewall Rule Description Field

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by embedding payloads in the firewall rule description field via the filter API endpoint. The unsanitized...

CVE-2026-69240 Sequelize: SQL Injection (Oracle DB)

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. In the Oracle dialect, when val is a string and starts wit...