CVE-2026-19999

Open Asset Import Library Assimp (3DGS MDL7 Bone Transformation Key Parser) is affected. The vulnerability resides in MDLLoader.cpp in Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7, where manipulating transmatrix_count/pcBoneTransforms can cause a buffer overflow. It permits remote-based acce...

CVE-2026-19998

The CVE-2026-19998 entry concerns code-projects Online Shopping System 1.0, specifically the offersmail.php file. The vulnerability stems from manipulating the email parameter, enabling cross-site scripting (XSS). The description notes the attack can be performed remotely and that the exploit is ...

CVE-2026-19997

The CVE covers Webkul Bagisto up to 2.4.4, where manipulation of requests to /admin/sales/rma/requests in the Backend Sales RMA Endpoint can bypass authorization. It is a remote issue, with public exploit availability noted. The vendor states issues were identified in internal security processes ...

CVE-2026-19996

CVE-2026-19996 affects Webkul Bagisto (up to 2.4.4). The vulnerability resides in the Backend Customer Behavior Data Endpoint, specifically the /admin/customers area, where manipulation of the ID argument leads to improper privilege management. It can be exploited remotely; a public exploit exist...

CVE-2026-19995

Webkul Bagisto (up to 2.4.4) is affected in the RMA Message Handler, specifically the /customer/account/rma/send-message path. The vulnerability stems from manipulating the Message argument, leading to cross-site scripting. Remote exploitation is possible, and exploits have been publicly disclose...

CVE-2026-15623

CVE-2026-15623 describes an authenticated blind SQL injection in Google Cloud Chronicle SOAR’s legacy dashboard widget API for versions prior to 6.3.85. An authenticated attacker can cause blind SQL queries via a crafted request parameter. The issue is mitigated by the patch in version 6.3.85; no...

CVE-2026-19994

Webkul Bagisto (up to 2.4.4) is affected by a vulnerability in the Configuration Management module. Specifically, manipulating the action parameter in the file /admin/configuration/cache-management/execute can bypass authorization, potentially allowing remote exploitation. Public exploit code exi...

CVE-2026-22072

CVE-2026-22072 involves arbitrary URL loading in WebView, where loading external URLs can permit malicious JavaScript to steal user tokens. The connected document confirms the issue arises from WebView behavior, enabling token leakage with a CVSS v4.0 base score of 8.3 (HIGH), attack vector Netwo...

CVE-2026-14832

The ShopSmart Loyalty for WooCommerce WordPress plugin (≤1.0.0) exposes the shopsmart_check_phone AJAX endpoint without authorization checks, allowing unauthenticated users to retrieve any customer's loyalty profile (name, email, account balance) by supplying a known phone number; CVSS 5.3 MEDIUM...

CVE-2026-13700

The WooMS WordPress plugin (versions through 9.14) fails to validate a user-supplied URL before issuing server-side requests and attaches stored third-party integration credentials to each request. When the data-sync feature is enabled, unauthenticated attackers can perform Server-Side Request Fo...

CVE-2026-19993

Webkul Bagisto (up to 2.4.4) contains a vulnerability in the RMA State Validation flow, specifically the /customer/account/rma/update-status endpoint. An attacker may remotely trigger manipulation of the behavioral workflow via this unknown functionality, with exploitation disclosed publicly. CVS...

CVE-2026-19992

CVE-2026-19992 affects the Orange View Limited DualSafe Password Manager & Digital Vault Extension for Chrome, up to version 1.4.35. The vulnerability is in an unspecified function of the component using a postMessage-based Bridge, enabling information disclosure. Exploitation is remote and repor...

CVE-2026-19988

The CVE-2026-19988 affects the Alaev SEO Tools Extension for Chrome (up to version 1.0.10). The vulnerability targets Popup UI, specifically the addDiv function in src/popup.html, enabling basic cross-site scripting via manipulation. Exploitation is possible remotely and the exploit is public. No...

CVE-2026-74579

CVE-2026-74579 is a vulnerability in the Linux kernel 's netfilter subsystem, specifically in the nft_payload_offload_mask() function within nft_payload.c. When building an offload match mask for a partial IPv6 address match (e.g., field_len=16, priv_len=1), the code performs a shift of 1 <

CVE-2026-19987

SourceCodester Best Employee Management System 1.0 contains a vulnerability in the /assets/uploadImage/Profile/ function that allows information exposure via directory listing. Exploitation is described as remotely possible. The available documents identify the affected software and the exposed r...

CVE-2026-19986

The CVE-2026-19986 case concerns Adblock for Youtube Extension (Chrome) up to 7.2.1. The vulnerability lies in the updateDynamicRules function in contentscript.js of the Event Listener, where manipulation of the yt-anti-adblock-detected argument leads to improper authorization. The issue enables ...

CVE-2026-19984

CVE-2026-19984 affects jkawamoto/mcp-florence2 (up to 0.3.13). The vulnerability is in the get_images function of src/mcp_florence2/init .py where the src argument is manipulated, enabling server-side request forgery (SSRF). The issue can be triggered remotely and a PoC exploit has been published...

CVE-2026-19983

GL.iNet devices (A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000, XE3000) running 4.8.x are affected by a vulnerability in NAS Command Service due to improper processing of /usr/bin/gl_nas_sys, enabling remote OS command injection. The issue allows a remote attacker to execute arbitrary com...

CVE-2026-19982

CVE-2026-19982 affects GL.iNet BE9300 and MT6000 devices running 4.8.x, in the firewall-management RPC component. The issue arises from input manipulation of dest_port/dest_ip, leading to an OS command injection. A remote attacker could trigger this without user interaction. Upgrading to version ...

CVE-2026-19981

GL.iNet devices in the family listed (A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000, XE3000) are affected by CVE-2026-19981. A vulnerability in the Wi-Fi Timer Power-Schedule Feature allows remote attacker manipulati...