CVE-2026-77803

Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021 , contains a front-end request desynchronization vulnerability in the proxy request forwarding component. The root cause is that the software forwards requests containing both Content-Length and Transfer-Encoding ...

CVE-2026-77802

Progress Telerik Fiddler Classic for Windows versions prior to v6.0.20262.10021 are vulnerable to HTTP request smuggling in the proxy request forwarding component. The issue arises because the software forwards requests with multiple conflicting Content-Length headers verbatim, while only using t...

CVE-2026-39783

The WP SYNTEX Polylang plugin (versions n/a through 3.8.7 ) is vulnerable to a Missing Authorization vulnerability (CWE-862 ). This flaw allows an attacker to Retrieve Embedded Sensitive Data . No specific exploit details or remediation steps are provided in the documents.

CVE-2026-103684

The WP Event Solution plugin (versions n/a through 4.1.25 ) is vulnerable to a Missing Authorization (CWE-862) issue. This Broken Access Control vulnerability allows for the exploitation of incorrectly configured access control security levels. The impact involves potential low integrity changes,...

CVE-2026-105073

The WP Event Solution plugin for WordPress (versions n/a through 4.1.25 ) is vulnerable to Sensitive Data Exposure (CWE-497). This flaw allows an unauthorized actor to Retrieve Embedded Sensitive Data from the system. The vulnerability is classified as MEDIUM severity with a CVSS3.1 score of 5.3 ...

CVE-2026-63270

In certain versions of LibreOffice , a vulnerability exists where URLs can be constructed to expand environment variables or INI file values . This allows potentially sensitive information to be exfiltrated to a remote server when a user opens a document containing such links. The root cause is t...

CVE-2026-63269

On Linux , LibreOffice is vulnerable to Local File Inclusion (LFI) and GET Server-Side Request Forgery (SSRF) due to how it handles linked media via GStreamer . An attacker can provide a linked HLS playlist that causes GStreamer to read local files or remote URLs during document loading, potentia...

CVE-2026-63268

LibreOffice Calc is vulnerable to a Local File Inclusion (LFI) flaw when linking cell ranges to external data sources. An attacker can exploit the sql provider and sdbc:flat:file:// database href by naming a folder of local text files as a database. This allows a user to read local text files int...

CVE-2026-63267

LibreOffice Calc is vulnerable to Local File Inclusion (LFI) and GET Server-Side Request Forgery (SSRF) via the calcext:data-mappings and csv provider. The root cause is that the application automatically fetches external CSV data links saved in a document during the loading process. This allows ...

CVE-2026-63266

LibreOffice Calc is vulnerable to an arbitrary file write due to how it handles external data source links. An attacker can use a document to open an embedded Firebird database , which may write files to any location the user has permissions to access. The vulnerability is caused by a lack of dir...

CVE-2026-63277

LibreOffice Calc is vulnerable to Remote Code Execution (RCE) when opening a document that links a cell range to an external data source. An attacker can craft a document naming a Java database driver to be loaded from a remote location, causing the application to execute Java code from that sour...

CVE-2026-105307

A vulnerability exists in Casdoor up to version 3.161.1 involving the API Endpoint component. The issue resides in the ApiFilter function located within the routers/authz_filter.go file, where a manipulation can lead to missing authentication . This flaw allows for remote attacks. While an exploi...

CVE-2026-105396

The Heym library (versions before v0.0.112 ) is vulnerable to a token leakage flaw within the build_public_base_url() function. An unauthenticated attacker can spoof Origin or X-Forwarded-Host headers to redirect HITL (Human-in-the-Loop) review links to an attacker-controlled domain. By triggerin...

CVE-2026-94669

The Fluent Forms Pro Add On Pack plugin by WP ManageNinja LLC, versions up to and including 6.2.13 , is vulnerable to a Broken Access Control issue (CWE-862). The root cause is missing authorization which allows for the exploitation of incorrectly configured access control security levels . This ...

CVE-2026-105291

The software feelec-yishu feelcrm-os 1.0.0 contains a cross-site scripting (XSS) vulnerability in the Department Search Endpoint component. The root cause is located in the GroupController::index function within the file App/Feelcrm/Index/Controller/GroupController.class.php, where the manipulati...

CVE-2026-105290

The software feelec-yishu feelcrm-os version 1.0.0 is vulnerable to a server-side request forgery (SSRF) . The flaw exists within the getCurlData endpoint, specifically involving an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php. An attacker can remotely launch t...

CVE-2026-59788

A Stored XSS vulnerability exists in the email media type OAuth form because the application passes the Authorization endpoint value to window.open() without validating the URL scheme. This allows for the execution of a javascript: URL in the browser. An attacker can deliver a crafted media type ...

CVE-2026-59787

The Zabbix Perl SNMP trap receiver script (zabbix_trap_receiver.pl ) is vulnerable to an SNMP trap injection due to improper neutralization of the ZBXTRAP record delimiter in trap content. An attacker capable of sending SNMP traps can inject a record targeting a different host, leading to a loss ...

CVE-2026-59786

Zabbix Server and Proxy are vulnerable to a flaw where they accept active agent heartbeat messages without performing the required TLS check for configured PSK or certificate authentication. An attacker with access to the Zabbix trapper port can exploit this to report an arbitrary host as availab...

CVE-2026-59785

The Frontend host search functionality is vulnerable to an information disclosure flaw due to improper filtering in multiselect.get . This allows users with read access to filter by hidden fields, specifically stored IPMI and PSK credentials . By observing differences in search results, an attack...