CVE-2026-86677

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-96560

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-86679

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-88974

The WPGraphQL WordPress plugin (prior to version 2.22.2 ) contains an authorization bypass in the updatePost mutation. The root cause is that src/Mutation/PostObjectUpdate.php fails to enforce object-level edit_post capabilities and does not require the publish_posts capability for status transit...

CVE-2026-12974

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-63000

The REDAXO PHP-based content management system is vulnerable to a Cross-Site Request Forgery (CSRF) attack in versions prior to 5.21.2 . The root cause is that the rex_api_install_package_update function in redaxo/src/addons/install/lib/api/api_package_update.php fails to override the requiresCsr...

CVE-2026-63002

REDAXO, a PHP-based content management system, is vulnerable to Stored XSS in its Mediapool Sync page prior to version 5.21.2 . The root cause is the failure to apply rex_escape() to the $diffFiles variable in redaxo/src/addons/mediapool/pages/sync.php, which renders unregistered filenames from t...

CVE-2026-63001

A Stored Cross-Site Scripting (XSS) vulnerability exists in the REDAXO CMS (versions prior to 5.21.2 ) within the mediaIsInUse() handler located in redaxo/src/addons/media_manager/lib/media_manager.php. The root cause is the failure to apply rex_escape() to the Media Manager type name when constr...

CVE-2026-70125

This candidate has been reserved by an organization or individual " "that will use it when announcing a new security problem. When the candidate has been " "publicized, the details for this candidate will be provided...

CVE-2026-86583

The WordPress Plugin Import and export users and customers (versions

CVE-2026-18467

The WordPress Paytium plugin (Mollie payment forms & donations) is vulnerable to an unauthenticated privilege escalation in versions

CVE-2026-96543

An out-of-bounds heap write flaw exists in the GIMP PVR image loader . When processing a crafted non-square PVR texture, the pvr_decode_twiddle() function fails to perform bounds-checking on the destination offset, allowing attacker-controlled pixel data to be written beyond the allocated heap bu...

CVE-2026-96512

A flaw exists in sudo where rules using NOTBEFORE or NOTAFTER time-based restrictions, without the trailing 'Z' timezone indicator, rely on the TZ environment variable. Because sudo is a setuid-root program, an unprivileged local user can manipulate the TZ variable to shift the authorization wind...

CVE-2026-19599

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module...

CVE-2026-75825

ZohoCorp ManageEngine OpManager versions 12.8.710 and below are affected by an Authentication Bypass vulnerability when the Application Manager Plugin is enabled. Exploitation of this flaw could allow an attacker to bypass security controls. No specific root cause, exploit details, or remediation...

CVE-2026-86247

A race condition within a thread in Apache Tomcat Native allows client certificate verification requirements to be down-graded for certain configurations. This vulnerability affects versions 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 , with unsupported versions potentially impacted. To remediat...

CVE-2026-76978

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below are susceptible to a Command Injection vulnerability within the Diagnose Settings feature. Successful exploitation could allow an attacker to execute arbitrary commands on the affected system. Exploitation details a...

CVE-2026-86246

The Apache Tomcat Native library is vulnerable to an initialization of a resource with an insecure default vulnerability. The software enables insecure options by default, specifically including ALLOW_CLIENT_RENEGOTIATION , NO_EXTENDED_MASTER_SECRET , IGNORE_UNEXPECTED_EOF , and ALLOW_NO_DHE_KEX ...

CVE-2026-86243

A buffer over-read vulnerability exists in Apache Tomcat Native during the TLS handshake . This flaw allows a malicious user to trigger a Denial of Service (DoS) by causing a JVM crash . Affected versions include 2.0.0 through 2.0.15 and 1.3.0 through 1.3.8 , as well as potentially earlier unsupp...

CVE-2026-76979

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below are susceptible to an XML Injection vulnerability within the Rule Tracking Compare Policies feature. The vulnerability allows for High confidentiality impact as per the CVSS 3.1 score of 7.7. No specific exploit det...