CVE-2026-24074

CVE-2026-24074 is an out-of-bounds write in a Video component on Qualcomm platforms. The root cause is memory corruption that occurs when data with large offset and length values exceeds buffer limits during data copy operations. The CVSS 3.1 score is 7.8 (HIGH) with a local attack vector, low co...

CVE-2026-24073

CVE-2026-24073 is an out-of-bounds write in Qualcomm's Video component, specifically in the processing of decode statistics . The root cause is insufficient validation of an offset against structure size , leading to memory corruption. The vulnerability is rated CVSS 3.1 7.8 (HIGH) with a local a...

CVE-2025-59607

CVE-2025-59607 is an Untrusted Pointer Dereference vulnerability in Qualcomm Windows Compute , where memory corruption occurs when copying large input data that exceeds normal allocation limits. The flaw is rated HIGH (CVSS 7.8) with a local attack vector, low complexity, and low privileges requi...

CVE-2026-50604

CVE-2026-50604 affects the Acer Agent Service component bundled with NitroSense and PredatorSense software. The root cause is a missing authentication check during the socket handshake process, which allows an unauthenticated local attacker to establish a connection and access functionality that ...

CVE-2026-50603

CVE-2026-50603 affects the Acer Agent Service component bundled with NitroSense and PredatorSense . The root cause is a hard-coded AES encryption key embedded in the software, which under certain circumstances allows a local attacker (with no privileges and no user interaction) to access protecte...

CVE-2026-92839

Canva Desktop versions prior to v1.125.0 are affected by a double decoding flaw in the application's deeplink handler. An attacker can exploit this to load arbitrary same-origin content under a victim's active session, resulting in a Low integrity impact with no confidentiality or availability im...

CVE-2026-86311

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin (versions up to and including 1.8.44 ) is vulnerable to Stored Cross-Site Scripting (XSS) via its Shortcode Attributes due to insufficient input sanitization and output escaping. According to the initial description, the ...

CVE-2026-89064

All-in-One WP Migration and Backup for WordPress (≤ 7.110 ) contains an unauthenticated Insufficient Credential Protection flaw discovered by Jakub Herman. The Ai1wm_Main_Controller::init() method, registered on the admin_init hook, reads $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] from...

CVE-2026-92838

A DLL hijacking vulnerability in the GeoVision GV-Remote E-Map desktop application allows a local attacker to place a malicious DLL in a directory searched before the legitimate library location, achieving arbitrary code execution in the context of the GV-Remote E-Map process. Exploitation requir...

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 (September 2026 release) contain a stack-based buffer overflow caused by inadequate bounds checking when parsing Affinity document files. A threat actor could craft a malicious Affinity document that, when opened by a user, may lead to arbitrary code exec...

CVE-2021-3030

Cute Editor for ASP.NET 6.4 (by CuteSoft) is vulnerable to reflected cross-site scripting (CWE-79) via improper validation of the Theme GET parameter in colorpicker_more.aspx. A remote, unauthenticated attacker can craft a URL that, when opened by a victim authenticated to the target site, execut...

CVE-2025-55787

MailData Email Archiving System v4.2 and earlier contains a SQL injection vulnerability, as described in the initial CVE entry. CISA's SSVC assessment rates exploitation as none (no known in-the-wild exploitation at time of assessment), the vulnerability as automatable , and the technical impact ...

CVE-2026-52483

CVE-2026-52483 affects the MitraStar GPT-2741GNAC-N2-SV router running firmware BR_g8.10_1.11(WVK.0)b46 . The ping diagnostics and similar functions are vulnerable to arbitrary OS command execution by authenticated users who send a crafted POST request to /cgi-bin/device-management-utilities-inte...

CVE-2026-65388

Apple's containerization library (apple/container) is vulnerable to a credential disclosure attack. A remote attacker who controls a container registry can redirect a client's token request to an attacker-chosen host, leaking the victim's registry credentials . Rapid7 classifies the issue as URL ...

CVE-2026-61599

djust is a Django extension providing Phoenix LiveView-style reactive server-side rendering with Rust-powered performance. Prior to version 1.0.7 , the live transport resolves the LiveView to mount from a client-supplied dotted path by calling __import__(), executing a module's top-level code bef...

CVE-2026-61589

djust , a Phoenix LiveView-style reactive server-side rendering library for Django, had a tenant resolution flaw in versions prior to 1.0.7 . The WebSocket handle_mount and ViewRuntime._build_request rebuilt the HttpRequest via RequestFactory().get(...) without an HTTP_HOST header, causing reques...

CVE-2026-61596

djust , a Django library providing Phoenix LiveView-style reactive server-side rendering with Rust-powered performance, had a broken object-level access control (IDOR) flaw prior to version 1.0.7 . Per-object authorization (get_object + has_object_permission) was enforced on WebSocket mount and e...

CVE-2026-61588

djust , a Phoenix LiveView-style reactive server-side rendering framework for Django with Rust-powered performance, had a data-exposure flaw prior to version 1.0.7 . When a Django Model instance was assigned to a public view attribute , djust serialized the entire object to the client without a s...

CVE-2026-61594

djust is a Phoenix LiveView-style reactive server-side rendering library for Django with Rust-powered performance. Prior to version 1.0.7 , its live WebSocket transport authorized view mounts via check_view_auth rather than Django's View.dispatch() chain. This caused standard Django authorization...

CVE-2026-61591

djust (a Phoenix LiveView-style reactive server-side rendering framework for Django with Rust-powered performance) is vulnerable to privilege escalation and state injection prior to version 1.0.7 . When views opt into state snapshots, the unsigned state_json embedded in the client page was restor...