CVE-2026-76834

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901: the function param_check_serialized_array() fails to reject payloads using negative integer array keys . Unauthenticated attackers can submit crafted serialized PHP objects via POST to htsrv/call_plugin.php,...

CVE-2026-12284

Mattermost Desktop App versions

CVE-2026-76781

CVE-2026-76781 is a NULL pointer dereference in libxml2 's XML catalog parsing. When a nextCatalog element lacks its mandatory catalog attribute, the parser dereferences a NULL pointer, causing the application to crash and resulting in a Denial of Service . The attack vector is local with user in...

CVE-2026-75588

Mattermost Desktop App versions

CVE-2026-92880

An out-of-bounds write vulnerability exists in vgmstream (versions up to r2117), specifically in the function vadpcm_read_coefs_be within the file src/coding/vadpcm_decoder.c, part of the EA SCHl parser component. The flaw is triggered by manipulation of the entry/entries argument, allowing a rem...

CVE-2026-26950

Dell SmartFabric Manager versions prior to 2.2.1 contain an Insufficient Verification of Data Authenticity vulnerability. A low-privileged attacker with remote network access could exploit this to achieve elevation of privileges , resulting in high confidentiality and integrity impact with no ava...

CVE-2026-87742

A flaw in quarkus-websockets-next allows a remote attacker to trigger a Denial of Service by streaming messages over a single connection faster than the application can process them. The root cause is unbounded message buffering combined with a lack of read backpressure , which rapidly exhausts h...

CVE-2026-54471

Dell SmartFabric Manager versions prior to 2.2.1 contain an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low-privileged remote attacker could potentially exploit this to achieve information disclosure , though user interaction is required. The CVSS 3.1 score is 3.5...

CVE-2026-79752

CakePHP , a rapid development framework for PHP, is affected by an SQL injection vulnerability in src/Database/FunctionsBuilder.php. The methods FunctionsBuilder::cast , ::extract , ::datePart , and ::dateAdd accept user-controlled dataType, part, or unit values and incorporate them into generate...

CVE-2026-61793

nuxt-og-image (NPM module for Nuxt.js), versions >= 6.0.2,

CVE-2026-81447

Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could exploit this flaw, resulting in information disclosure and information tampering . The CVSS v3.1 base sco...

CVE-2026-63459

Vendure (open-source headless commerce platform) prior to 3.6.5 contains a stored XSS in its Admin Dashboard. The RichTextDescriptionCell component strips HTML by assigning an administrator-controlled description field to a live element's innerHTML and then reading textContent. This pattern still...

CVE-2026-63461

Vendure , an open-source headless commerce platform, is vulnerable in its public Shop API products, collections, and facets queries prior to 3.6.5 . The mandatory visibility guards (Product.enabled = true, Collection.isPrivate = false, Facet.isPrivate = false) were combined with caller-supplied f...

CVE-2026-63472

Vendure , an open-source headless commerce platform, is vulnerable to account takeover via its external authentication system. In ExternalAuthenticationService.createCustomerAndUser, an existing customer is matched by email address alone and a new external authentication method is attached withou...

CVE-2026-63460

Vendure , an open-source headless commerce platform, is vulnerable to an unauthenticated Regular Expression Denial of Service (ReDoS) prior to version 3.6.5 . The public Shop GraphQL API exposes StringOperators.regex, which passes a user-supplied pattern to a synchronous JavaScript UDF registered...

CVE-2026-80356

Dell OpenManage Server Administrator (OMSA) , versions prior to 11.1.0.3 , is affected by an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. A low-privileged attacker with local access can exploit this flaw to expose sensitive information. The vulnerability is rated CVSS...

CVE-2026-71538

@cyclonedx/cyclonedx-npm prior to 6.0.0 is vulnerable to a Windows-specific shell injection in the fallback execution path of src/npmRunner.ts, used when npm_execpath does not resolve the npm CLI. An untrusted value passed to the --workspace option is incorporated into a shell command without san...

CVE-2026-81446

Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 are affected by a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote network access can exploit this flaw, resulting in a high confidentiality impact with changed scope , yielding a CVSS ...

CVE-2026-85078

Sanic is an open-source Python web server/framework. In version 25.12.0 , its core HTTP/1.1 chunked-body handling fails to fully consume the trailer portion after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-control...

CVE-2026-81445

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain an Improper Privilege Management vulnerability. A high-privileged attacker with remote access could exploit it to achieve elevation of privileges , resulting in high impact to confidentiality, integrity, and availability (CVS...