CVE-2026-6640

The Media Library Assistant WordPress plugin is vulnerable to Stored Cross-Site Scripting via the mla_link_attributes parameter in all versions up to and including 3.35 , caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher...

CVE-2026-6641

Media Library Assistant is a WordPress plugin vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.35 . The flaw resides in the mla_gallery shortcode: when the mla_output parameter is set to paginate_links, the mla_link_href parameter is processed by _paginate_links()...

CVE-2026-89179

WeenyGenius , a computer lab management system by Howyar Technologies , is affected by a Missing Support for Integrity Check vulnerability. An unauthenticated attacker on the same (adjacent) network can intercept a student's connection packet and replay it, forging the appearance that the student...

CVE-2026-89178

WeenyGenius , a computer lab management system by Howyar Technologies , suffers from an Origin Validation Error that allows unauthenticated attackers on the same network to spoof the teacher workstation and send broadcast packets, causing student computers to attempt to establish a connection wit...

CVE-2026-89177

WeenyGenius is a computer lab management system by Howyar Technologies . The vulnerability stems from reliance on ZMTP Null mode , an unauthenticated zero-message-transport-protocol handshake that provides no encryption or integrity. An unauthenticated attacker on the same (adjacent) network can ...

CVE-2026-89176

WeenyGenius is a computer lab management system developed by Howyar Technologies that suffers from a Missing Authentication vulnerability. Unauthenticated attackers on the same network can spoof student or teacher endpoints. Impersonating a student can disrupt normal classroom operations, while i...

CVE-2026-89175

The Smart Video Intercom System developed by Kingdom Communication Associated contains a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration values. The CVSS 3.1 score is 5.3 (MEDIUM)...

CVE-2026-89174

The Smart Video Intercom System developed by Kingdom Communication Associated suffers from a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts by performing a large number of login attempts, resulting in a high confidentiality impact ...

CVE-2026-89173

The Smart Video Intercom System developed by Kingdom Communication Associated is affected by a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses, allowing them to discover which accounts exist on...

CVE-2026-73785

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service DoS...

CVE-2026-62110

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-62109

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-87908

multiparty , a Node.js library for parsing multipart/form-data request bodies, is affected by a Denial of Service vulnerability in versions 2.1.0 through 4.3.0 . The root cause is that the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. A...

CVE-2026-62111

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-62112

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-62113

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-73784

A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user...

CVE-2026-62114

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-13326

CVE-2026-13326 affects Qt NFC 's QNdefNfcTextRecord component, where an out-of-bounds read in language code length parsing (combined with an integer underflow) allows a physically proximate attacker to trigger a denial of service or limited memory disclosure via a crafted NFC tag. The CVSS 4.0 sc...

CVE-2026-86815

The BackWPup WordPress plugin (versions 5.2.2–5.7.4 ) lacks proper authorization on several REST API routes used for job, backup-destination, and backup-execution management. Users holding a plugin-defined, administrator-assigned limited role can create and execute backup jobs, enabling exfiltrat...