An integer overflow vulnerability in the GIMP file-pvr plug-in allows heap-based buffer overflow via malicious .pvr files, potentially leading to arbitrary code execution or application crashes.

The lopdf Rust library is vulnerable to stack exhaustion via unbounded recursion when parsing deeply nested PDF objects, allowing unauthenticated attackers to cause a denial-of-service via SIGABRT.

An authorization flaw in the Arcane user management API allows users with the 'users:update' permission to overwrite administrative credentials and hijack global administrator accounts.

CVE-2026-59963 allows an authenticated user to bypass object-level authorization and access, share, or exfiltrate private recipes via utility API endpoints.

Authenticated users can exploit a blind Server-Side Request Forgery vulnerability in Tandoor Recipes versions prior to 2.6.10 by manipulating AI provider URL inputs to map internal network resources.

An authenticated OS command injection vulnerability (CVE-2026-102608) in ZoneMinder versions prior to 1.38.3 allows remote code execution via unsanitized monitor names during event export operations.

An unauthenticated arbitrary file read vulnerability (CVE-2025-10952) in the ml-logger stream_handler allows remote attackers to enumerate and exfiltrate sensitive files from the host filesystem.

LingGuo-Drama through commit 8a6924a is vulnerable to an Insecure Direct Object Reference (IDOR) flaw allowing unauthorized access, modification, and deletion of user projects.

99AI versions 4.3.0 and earlier contain a missing authentication vulnerability in the /api/chatLog/exportExcel endpoint, enabling unauthenticated attackers to exfiltrate sensitive user chat logs.

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to access private knowledge bases by enumerating sequential ID values.

OtterMind Nubase versions through 0.1.4 are vulnerable to an authentication bypass in the storage API, allowing unauthenticated attackers to read and delete private objects.

Authenticated users can exploit an SQL injection vulnerability in the WebVella ERP EQL query API to exfiltrate sensitive data from user and role tables.

An IDOR vulnerability in Shaiwz data-platform-open allows authenticated users to access, enumerate, and modify foreign workspace datasources by manipulating numeric IDs in API requests.

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows unauthorized tenants to escalate privileges and access sensitive financial data by forging the unsigned X-USERINFO header.

Magistrala through version 1.0.0 contains an authorization bypass flaw allowing authenticated workspace members to perform unauthorized certificate operations across different tenants.

Authenticated low-privileged users can exploit missing authorization checks in EFAK 5.1.0 and earlier to escalate privileges and perform administrative actions on managed Kafka clusters.

APIPark versions through 1.9.7-beta are vulnerable to an authorization bypass allowing authenticated team managers to manipulate team IDs to access, modify, or delete resources belonging to other teams.

Course-tencent-cloud through version 2.0.1 contains an authentication bypass vulnerability allowing attackers to brute force 6-digit verification codes due to a lack of rate limiting or invalidation.

Chaskiq version 2.0.3 and earlier contains a server-side request forgery vulnerability in the createUrlUpload GraphQL mutation, allowing unauthenticated attackers to access internal resources including cloud metadata services.

ChronoFrame versions 1.0.0 and earlier are vulnerable to a missing authentication flaw in API handlers, allowing unauthenticated attackers to reconfigure instance storage and site settings.

The bbs-go application up to version 4.4.6 is vulnerable to an authentication bypass via the /api/login/google_one_tap endpoint due to missing validation of the Google ID token audience claim.

An authorization vulnerability in the sshportal management shell allows authenticated non-admin users to retrieve decrypted backend private SSH keys and bypass access controls.

OpenBMB StaffDeck versions through 0.5.6 contain an authentication bypass vulnerability allowing attackers to forge administrator session tokens via a hard-coded app_secret.

Helical Insight versions through 7.0.0 contain an authenticated SQL injection vulnerability in the /executeDatasource endpoint that allows attackers to manipulate backend database queries.

ZKEACMS versions through 4.4 contain a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs, allowing unauthenticated attackers to forge JWT bearer tokens and bypass authentication.

HestiaCP versions prior to 1.10.5 contain an authorization bypass vulnerability allowing non-privileged administrators to impersonate the ROOT_USER and execute arbitrary cron tasks.

AllData versions 0.7.1 and earlier are vulnerable to unauthenticated JDBC injection via the /jobJdbcDatasource/test endpoint, enabling remote attackers to perform arbitrary file read via the MySQL allowLoadLocalInfile parameter.

The netdisk-fast-download package through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt cloud-drive credentials via a hard-coded AES key.

Huly Platform versions through 0.7.432 contain a missing authorization vulnerability in the mergeSpecifiedPersons RPC, enabling authenticated account takeover.

Jpom versions through 2.11.12 contain an authorization bypass vulnerability allowing authenticated users to perform unauthorized file operations on SSH hosts across different workspaces.

UNC7017 performed an opportunistic supply chain attack by intermittently compromising AOMEI update servers to deliver backdoors, credential-harvesting pop-ups, and remote administration tools to Windows users.

Moxa has disclosed two critical vulnerabilities, CVE-2026-109812 and CVE-2026-109813, affecting the AIG-302 industrial computing series firmware version 1.4.1 and earlier.

Google Chrome contains multiple vulnerabilities that can be exploited by a remote, anonymous attacker to achieve arbitrary code execution or cause a denial-of-service condition.

A vulnerability in Nutanix AOS and Nutanix Prism Central allows a remote, unauthenticated attacker to bypass security controls and execute arbitrary code with administrative privileges.

Apache Camel's camel-ftp component contains a path traversal vulnerability (CVE-2026-79983) allowing unauthorized file operations outside the intended directory via malicious server-supplied file listings.

The WP Sessions Time Monitoring Full Automatic WordPress plugin up to version 1.1.5 is vulnerable to stored XSS via multiple input parameters, allowing unauthenticated attackers to execute arbitrary scripts in the context of user sessions.

An authenticated attacker can trigger a heap-based buffer overflow in spice-server during VM live migration by exploiting an integer truncation vulnerability in the GLZ encoder dictionary restore path.

A local privilege escalation vulnerability in the macOS diskutil utility allows unprivileged users to gain root access via manipulated filesystem mounting.

An unauthenticated stored XSS vulnerability in GoSMTP Pro (<= 1.2.3) allows attackers to inject arbitrary web scripts via email log body content.

The Vitepos plugin for WooCommerce is vulnerable to unauthenticated SQL injection via the 'src_by' parameter, potentially allowing unauthorized database information extraction.

An observable response discrepancy vulnerability (CVE-2026-14177) in Ikas E-Commerce Infrastructure allows unauthorized actors to perform account footprinting by analyzing varying platform responses.

An arbitrary file upload vulnerability in the DoubleScale CRM plugin for WordPress up to version 1.5.1 allows authenticated subscribers to achieve remote code execution when the Helpdesk module is enabled.

The SureCart plugin for WordPress (<= 4.9.4) is vulnerable to Stored Cross-Site Scripting (XSS) via the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of victims viewing specific e-commerce pages.

An unauthenticated stored cross-site scripting vulnerability in the User Registration PRO premium WordPress plugin allows attackers to inject malicious scripts via the HTTP Referer header.

An authentication bypass vulnerability (CVE-2026-75903) in the Vulnity Security plugin for WordPress allows unauthenticated attackers to retrieve credentials and gain administrative access via misconfigured Nginx path restrictions.

The WPConsent WordPress plugin up to version 1.1.9 is vulnerable to stored Cross-Site Scripting (XSS) via mXSS, allowing unauthenticated attackers to execute arbitrary scripts in a user's browser session.

The YaySMTP WordPress plugin (<= 2.7.7) is vulnerable to arbitrary file upload due to insufficient validation in the putFile function, allowing authenticated users to achieve remote code execution.

Authenticated users with specific plugin privileges can achieve remote code execution in WP Photo Album Plus via command injection in the update-photo AJAX action.

The CP Multi View Events Calendar plugin for WordPress contains a Stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject arbitrary web scripts via the CalendarTitle parameter.

An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in HivePress plugin versions 1.7.32 and earlier allows attackers to inject malicious scripts into attribute fields.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment parameter, allowing unauthenticated attackers to execute arbitrary web scripts.

The Search Regex WordPress plugin version 3.5 is vulnerable to PHP Object Injection, allowing authenticated users with subscriber access to achieve remote code execution via a POP chain.

The Sunshine Photo Cart plugin for WordPress is vulnerable to unauthenticated PHP object injection in versions up to 3.7.4, which can be leveraged for RCE if secondary plugins provide a viable POP chain.

The Schema & Structured Data for WP & AMP plugin is vulnerable to unauthenticated stored XSS via the 'saswp_review_text' parameter due to insufficient input sanitization and an exposed, ineffective nonce.

An unauthenticated stored DOM-based XSS vulnerability (CVE-2026-95686) in the Opti-Behavior plugin for WordPress allows attackers to inject malicious scripts via a publicly accessible nonce-protected ingest endpoint.

Unauthenticated attackers can exploit insufficient input sanitization in the Hide My WP Ghost plugin to inject persistent malicious scripts into WordPress pages.

The PilotPress WordPress plugin (<= 2.0.43) contains a logic flaw in the update_cc_details() AJAX handler that allows an authenticated attacker to trigger an administrative account takeover.

The NotificationX plugin for WordPress contains a Stored Cross-Site Scripting vulnerability in the name parameter, allowing unauthenticated attackers to execute arbitrary web scripts.

An unauthenticated Stored XSS vulnerability in the Salon Booking System WordPress plugin allows attackers to inject malicious scripts into checkout fields.

The SiteOrigin CSS WordPress plugin contains a stored DOM-based XSS vulnerability via the 'url' parameter, allowing unauthenticated attackers to execute arbitrary web scripts.

The Simply Schedule Appointments WordPress plugin is vulnerable to stored XSS via the 'status' parameter, allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser session.

An unauthenticated stored XSS vulnerability in Ultra Addons for Contact Form 7 (<= 3.5.54) allows attackers to bypass file extension filters and execute arbitrary JavaScript.

The User Profile Builder plugin for WordPress is vulnerable to unauthenticated stored XSS in the 'First Name' field when Email Confirmation is enabled, allowing script injection into user profiles.

The Nexter Extension plugin for WordPress is vulnerable to privilege escalation (CVE-2026-111114) allowing authenticated users to restore elevated roles due to improper state cleanup during bulk demotions.

An authorization bypass vulnerability in the Klarna for WooCommerce plugin allows unauthenticated attackers to enumerate store orders and exfiltrate customer PII via the order-pay endpoint.

The InstaWP Connect plugin for WordPress, versions 0.1.4.1 and earlier, contains a privilege escalation vulnerability allowing authenticated users to extract the master API key and mint administrator session tokens.

The Groundhogg WordPress plugin contains an arbitrary file deletion vulnerability in the copy_file function that allows authenticated users with specific capabilities to remove critical server files.

The Modula Image Gallery plugin for WordPress is vulnerable to unauthenticated information exposure via the REST API, allowing attackers to retrieve plaintext credentials for password-protected galleries.

An authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress allows unauthenticated attackers to hijack user sessions.

The FluentCart plugin for WordPress up to version 1.7.0 contains an IDOR vulnerability allowing unauthenticated attackers to exfiltrate customer billing and shipping PII via sequential ID enumeration.

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (<= 7.5.5) is vulnerable to Stored XSS due to improper input sanitization, allowing unauthenticated attackers to execute arbitrary scripts via comment content.

The Backuply plugin for WordPress is vulnerable to second-order SQL injection, allowing authenticated attackers to achieve privilege escalation through malicious backup restoration.

An unauthenticated stored XSS vulnerability in the Flying Scripts WordPress plugin (CVE-2026-109990) allows attackers to execute arbitrary JavaScript by bypassing core sanitization through an output-buffer rewriter.

The RSS Aggregator by Feedzy WordPress plugin is vulnerable to Stored Cross-Site Scripting via malicious RSS feed input, allowing unauthenticated attackers to execute arbitrary scripts in the context of the target site.

An unauthenticated stored XSS vulnerability in the Colibri Page Builder plugin for WordPress allows attackers to inject malicious scripts via the comment parameter that execute in the context of user browsers.

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to unauthenticated privilege escalation due to insufficient entropy in activation token generation when configured to use the 'hashids' encoding method.

Authenticated attackers can exploit a SQL injection vulnerability in specific Frappe HRMS API endpoints to extract sensitive database information due to missing input validation.

An authenticated user with the Monitor role in WildFly can exploit a path traversal vulnerability in the take-snapshot operation to perform unauthorized reads of sensitive configuration files.

A local improper authorization vulnerability in Lenovo Baiying PC Client allows an authenticated user to achieve privilege escalation through arbitrary code execution.

A vulnerability in the Lenovo Legion Zone application allows an attacker on the same logical network to execute arbitrary code on the host system.

A Server-Side Request Forgery (SSRF) vulnerability in the bitcoinj Payment Request Handler component allows remote attackers to perform unauthorized requests via manipulation of the pki_type argument.

A local privilege escalation vulnerability in cifs-utils (CVE-2026-104715) allows unprivileged users to gain root access by injecting malicious mount options into a user-controlled credentials file used by mount.cifs.

ClassroomIO versions 1.0.0 and earlier contain an authorization flaw in API routes allowing authenticated students to modify or delete arbitrary lesson content across courses.

An authorization bypass vulnerability in cool-admin-midway through version 8.0.0 allows department-restricted administrators to perform unauthorized administrative actions on users outside their assigned scope.

CRMEB versions 5.6.1 through 6.0.0 contain an IDOR vulnerability allowing authenticated attackers to enumerate and hijack order details via the gift-order API.

MacCMS versions v10 through 2026.1000.4056 are vulnerable to an unauthenticated account takeover via brute-force exploitation of the password recovery function.

An incorrect authorization flaw in ThinkCMF RestAdminBaseController allows restricted administrators to bypass access controls, leading to privilege escalation and unauthorized data access.

OpenHealth versions 0.2.0 and earlier are vulnerable to unauthenticated access within the /api/health-data/ endpoint, allowing remote attackers to read, modify, or delete sensitive medical records.

Snap7 versions up to 1.4.3 contain an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() triggered by malicious S7 peer responses, potentially leading to memory corruption or process crashes.

An unauthenticated denial-of-service vulnerability in DragonflyDB allows remote attackers to cause instance termination via unbounded memory allocation.

NivoCart through 2.5.1 contains a missing authorization vulnerability in the account/order module that allows unauthenticated attackers to exfiltrate guest order invoices by iterating order identifiers.

A build-time dependency issue in FrankenPHP causes cross-user session ID leakage when the PHP session extension is loaded as a shared module in worker mode.

Authenticated users can escalate privileges to administrator or manage plugins by invoking unauthorized JSON-RPC methods in Leantime.

The @opennextjs/cloudflare component contains a vulnerability (CVE-2026-100409) where inconsistent path decoding allows attackers to bypass middleware-based authorization and retrieve cached content.

The dio_http2_adapter library fails to sanitize Authorization, Cookie, and Proxy-Authorization headers when following cross-origin HTTP redirects, enabling credential theft.

The kin-openapi library lacks cycle detection during runtime schema validation, allowing attackers to trigger an unrecoverable Go runtime stack overflow that terminates the entire host process.

A vulnerability in the containerd CRI implementation (CVE-2026-95837) allows untrusted container checkpoints to bypass configured security contexts, enabling privilege escalation to root.

Claude Code and Claude Desktop failed to verify the integrity of git checkouts during plugin installation, allowing attackers to substitute pinned commits with malicious code via branch name collision.

An unauthenticated reflected XSS vulnerability (CVE-2026-104252) in the Vitess vttablet twopczHandler allows attackers to execute arbitrary JavaScript in the context of an operator's session, potentially exposing sensitive debug information.

Authenticated users with QinQ edit privileges can leverage an OS command injection vulnerability in Netgate pfSense CE 2.7.0 through 2.9.0 to execute arbitrary commands as root.

CISA Malcolm versions v26.07.1 and earlier contain multiple high-severity vulnerabilities, including authentication bypass, SSRF, and authorization flaws, allowing unauthenticated or low-privileged users to gain administrative control.

An authenticated path traversal vulnerability in Thermo Fisher Torrent Suite Software (CVE-2026-107777) allows remote attackers to read arbitrary files from the affected server.

A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability in Ansible Operator Plugins to achieve arbitrary code execution via crafted Custom Resource specifications.

Multiple vulnerabilities in SonicWall Network Security Manager versions prior to 4.4.0, including CVE-2026-100232 and CVE-2026-96540, allow unauthenticated attackers to achieve remote code execution and bypass security policies.

Multiple vulnerabilities, including remote code execution and cross-site scripting, affect Drupal versions 10.6.x, 11.3.x, and 11.4.x, requiring immediate patching to prevent unauthorized code execution.

An authenticated remote attacker can exploit a vulnerability in Gitea to achieve arbitrary code execution with administrator privileges, leading to full system compromise.

A vulnerability in Netgate pfSense allows a remote, authenticated attacker to execute arbitrary code with administrator privileges.

A vulnerability in the Rancher container management platform allows a remote, authenticated attacker to perform a privilege escalation, potentially gaining unauthorized administrative access within the cluster environment.

CVE-2017-11610 is a remote code execution vulnerability in Supervisor versions 3.3.2 and earlier that allows authenticated attackers to execute arbitrary system commands via the XML-RPC interface.

A proof-of-concept exploit has been published for CVE-2024-36823, a high-severity information disclosure vulnerability affecting Ninjaframework Ninja 7.0.0.

CikaBika Bot is a Rust-based Remote Access Trojan (RAT) delivered via phishing that utilizes Discord for command-and-control and Ngrok for exfiltration of sensitive victim data.

CVE-2026-110912 allows an unauthenticated attacker on a local L2 network to disclose kernel heap and stack memory by sending malformed ARP requests with oversized length fields.

An authenticated RCE vulnerability in the Email Customizer for WooCommerce plugin allows subscriber-level users to inject and execute arbitrary PHP code.

The Mang Board WP plugin for WordPress through version 2.4.0 is vulnerable to stored cross-site scripting (XSS) via the 'data_type' parameter, allowing unauthenticated attackers to execute arbitrary scripts in victim browsers.

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting (XSS) via the 'order_email' parameter due to insufficient input validation.

The Checkout Field Manager plugin for WordPress contains an authorization bypass vulnerability allowing low-privileged authenticated users to delete arbitrary files from the Media Library.

The Link Library plugin for WordPress is vulnerable to unauthenticated time-based SQL injection via the 'link_url' parameter, enabling potential database information exfiltration.

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery via insecure Host header processing, allowing unauthenticated attackers to bypass URL allowlists and perform unauthorized requests.

Ellucian WebAdvisor 3.2 is vulnerable to an unauthenticated XXE injection, enabling remote attackers to perform SSRF, steal NTLMv2 hashes, and conduct arbitrary file read operations.

MoviePilot versions through 3.1.5 are vulnerable to command injection via the ExecuteCommandTool, allowing unauthenticated or low-privileged actors to achieve remote code execution.

IntentKit versions 2.6.3 and earlier contain an authorization bypass vulnerability allowing unauthenticated actors to execute restricted, state-changing tools by bypassing intended ToolBindingMiddleware per-request scoping.

Better Auth @better-auth/sso versions 1.7.0-rc.2 through 1.7.2 contain an authentication bypass vulnerability allowing attackers to impersonate other users via malicious SSO provider registration.

Heym versions 0.0.55 through 0.0.120 contain a privilege escalation vulnerability allowing shared collaborators to exfiltrate workflow credentials by overwriting error handlers.

An allowlist bypass in Renovate versions prior to 44.60.1 enables attackers to inject restricted environment variables via malicious configuration presets, leading to arbitrary code execution in child processes.

Renovate versions prior to 44.60.1 are vulnerable to an allowlist bypass that permits repository users to inject arbitrary HTTP headers via malicious shared presets.

GitPython versions prior to 3.2.0 contain a remote code execution vulnerability where the Git.ls_remote method improperly handles URLs, allowing arbitrary command execution via malicious remote-helper strings.

OpenSIPS versions 3.6.8 and 4.0.1 and earlier are vulnerable to a remote out-of-bounds read in the rtpproxy_offer and rtpproxy_answer functions, which can lead to denial-of-service or information disclosure.

The Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers libraries are susceptible to a billion laughs denial-of-service attack, where crafted YAML files with nested anchors cause memory exhaustion and process termination during conversion.

A vulnerability in Lenovo XClarity Controller 3 allows a remote, unauthenticated attacker to gain administrative privileges on the affected system, representing a significant security risk for managed infrastructure.

The sar2html 4.0.0 application is vulnerable to remote SQL injection via the 'sort' parameter in sar2html.py, enabling unauthenticated attackers to execute arbitrary database queries.

An authentication bypass vulnerability in Databasus versions 3.7.0 through 3.61.0 allows unauthenticated attackers to brute-force six-digit password reset codes due to a lack of rate limiting.

A missing authorization vulnerability in holaOS channel-gateway connectors (CVE-2026-110769) allows unauthorized messaging-platform users to trigger arbitrary agent tasks on the host system.

Gitingest versions 0.3.1 and earlier contain a symlink following vulnerability that allows unauthenticated attackers to read arbitrary files from the server's filesystem.

CVE-2026-86848 is a critical out-of-bounds access vulnerability in DPDK lib/vhost vhost-crypto caused by a double-fetch of a guest descriptor index, enabling a malicious guest to compromise the host backend.

A use-after-unmap vulnerability in the DPDK VDUSE handler allows for potential memory corruption and system instability due to improper vring pointer invalidation.

Authenticated users can achieve remote code execution in FV Flowplayer Video Player for WordPress <= 7.5.54.7212 by bypassing incomplete file type validation in the check_mimetype function.

A time-of-check time-of-use vulnerability in the DPDK lib/vhost component enables a heap buffer overflow via the VDUSE control-queue handler, potentially allowing arbitrary code execution.

The ADP Desktop SDK improperly transmits sensitive information in clear text, allowing local network attackers to intercept credentials and gain unauthorized access to Autodesk services.

An improper input validation vulnerability in the VPN daemon of Juniper Networks Junos OS on SRX Series allows an authenticated attacker to achieve remote code execution via a buffer overflow in AutoDiscovery VPN messages.

A vulnerability in the DPDK Generic Segmentation Offload (GSO) library allows remote or guest-supplied packets to trigger out-of-bounds memory read or write operations due to insufficient header size validation.

PCMan FTP Server versions through 2.0.7 contain a buffer overflow vulnerability in the PORT command handler that allows remote attackers to execute arbitrary code or trigger a denial of service.

A coordinated disruption action targeting the CoGUI, CoAceV, and CoFish_Ws phishing kits has impacted an ecosystem responsible for billions of malicious messages harvesting credentials and payment data from global organizations.

Portkey AI Gateway versions 1.14.0 through 1.15.2 are vulnerable to unauthenticated SSRF via the x-portkey-custom-host header, allowing attackers to access internal loopback and Docker host services.

An authentication and authorization bypass in F5 NGINX Kubernetes Ingress Controller (NIC) allows remote attackers to spoof request attributes and access protected paths by manipulating unsanitized X-Forwarded-* headers.

NGINX Gateway Fabric contains a configuration injection vulnerability in the AuthenticationFilter Custom Resource Definition that allows authenticated attackers to escape directive contexts and manipulate the shared NGINX data-plane configuration.

CVE-2026-15176 is a heap buffer overflow vulnerability in NGINX Plus and NGINX Open Source that allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code by sending crafted HTTP requests.

The @offactory/compress-fonts package before version 1.1.1 is vulnerable to OS command injection via unquoted font file path interpolation in child_process.execSync.

Turnpress versions 0.4.2 and earlier are vulnerable to OS command injection via malicious .docx filenames passed to the pandoc conversion process.

Beganovich snappdf versions 1.1.0 through 6.0.x are vulnerable to OS command injection via the setUrl() function on Windows, allowing unauthenticated attackers to achieve arbitrary code execution.

The xhtml2pdf library before version 0.2.19 contains an OS command injection vulnerability in the pisa.startViewer() function allowing arbitrary command execution via crafted filenames.

The @runnerty/executor-decompress package is vulnerable to OS command injection via crafted archive filenames, allowing arbitrary command execution within the Runnerty process context.

The buildebooks package before 0.2.2 contains an OS command injection vulnerability in lib/kindle.js that allows attackers to execute arbitrary system commands via crafted EPUB filenames.

MyReport Updater versions through 2.1.1 are vulnerable to local privilege escalation allowing low-privileged users to achieve SYSTEM execution via malicious DLL injection in osk.exe.

Report One MyReport Updater versions 2.1.1 and earlier contain an unauthenticated gRPC service vulnerability allowing remote attackers to hijack the update process and achieve SYSTEM-level code execution.

Kan versions 0.5.5 through 0.6.0 contain an unauthenticated SSRF vulnerability in the /api/download/attatchment endpoint that allows attackers to probe internal services and cloud metadata.

SmsForwarder through version 3.5.0 contains a missing authentication vulnerability in its embedded AndServer HTTP server, allowing attackers to remotely control the application and access sensitive data.

NullHub versions through 2026.5.29 contain a missing authentication vulnerability allowing unauthenticated remote access to management API endpoints.

L-SMASH versions through 2.14.5 contain a double free vulnerability in the NALU importer, allowing remote attackers to trigger heap corruption via a crafted Annex-B elementary stream.

Kaneo versions before 2.1.6 contain a missing authorization vulnerability (CVE-2025-71433) allowing authenticated users to bypass membership checks and perform unauthorized operations on arbitrary workspaces.

Gravitee API Management versions up to 4.12.22 allow unauthenticated remote attackers to forge JWTs using a default signing secret to impersonate any user, including administrators.

Cloud Commander versions 19.20.2 through 19.21.1 are vulnerable to a path traversal flaw in the GET /api/v1/pack endpoint allowing unauthenticated file exfiltration.

PgBouncer contains multiple vulnerabilities that can be exploited by a remote, unauthenticated attacker to cause a denial-of-service condition, bypass security controls, or escalate privileges to administrator level.

Multiple vulnerabilities in Ubiquiti UniFi network management software allow remote, unauthenticated attackers to execute arbitrary OS commands, bypass security controls, and disrupt service.

Multiple vulnerabilities in Fortinet FortiSIEM allow unauthenticated remote attackers to execute arbitrary code on the affected appliance, risking complete platform compromise.

Multiple vulnerabilities in Fortinet FortiAnalyzer and FortiManager enable remote, unauthenticated attackers to perform SQL injection attacks, potentially resulting in unauthorized data access.

Multiple vulnerabilities across several Fortinet products, including FortiOS and FortiManager, permit remote code execution, privilege escalation, and denial-of-service.

Microsoft disrupted a Chinese-language cybercriminal ecosystem where Storm-3119 provided illicit cloud infrastructure to Storm-2990, whose phishing kits facilitated large-scale credential theft globally.

A local privilege escalation vulnerability in the Linux kernel vhost subsystem allows an attacker to achieve root access by exploiting a lack of range checking in vhost_vq_meta_fetch().

Radar versions prior to 1.12.2 contain a missing authorization vulnerability allowing attackers to execute commands via the /api/local-terminal WebSocket endpoint.

The insights-runtime-extractor DaemonSet fails to correctly drop privileges when scanning containers, allowing malicious workloads to execute code as root in the host user namespace.

CVE-2024-21338 is a local privilege escalation vulnerability in the Windows Kernel affecting systems with Hypervisor-Protected Code Integrity enabled, allowing local administrators to elevate to kernel-level access via token manipulation.

Threat actors are using typosquatted domains to harvest WatchGuard VPN credentials via fake portals before delivering legitimate software to maintain victim trust.

Mistral Vibe versions before 2.25.4 are susceptible to a command permission gate bypass that enables arbitrary command execution via the bash promptvars feature.

SAP has released security updates addressing four critical-severity vulnerabilities, including SSRF, code injection, and authorization bypasses, across multiple enterprise platforms.

Vifm versions 0.8.1-beta through 0.14.4 are vulnerable to local command injection and privilege escalation due to insecure IPC FIFO reuse in shared temporary directories.

KDE Dolphin versions 24.08.0 through 26.08.2 are vulnerable to OS command injection through improper sanitization of directory names used in the slotDoubleClickViewBackground function.

Rovr through 0.10.3 contains an OS command injection vulnerability triggered by opening files with malicious names containing shell metacharacters, enabling arbitrary code execution under the user's context.

Kubeflow Model Registry versions up to 0.3.17 contain a server-side request forgery vulnerability allowing namespace users to exfiltrate ServiceAccount tokens and gain cluster-wide privileges.

An authenticated low-privileged user can exploit a missing authorization vulnerability in youlai-boot to assign administrative permissions to their own role and elevate privileges.

Wukong AICRM versions through 20260610 contain a missing authorization vulnerability that allows authenticated users to call administrative APIs, leading to account takeover via password reset.

Roo Code through 3.54.0 contains a command approval bypass in getCommandDecision() allowing attackers to execute denied shell commands by prefixing them with a redirection operator.

Xen Orchestra versions prior to 6.9.0 are vulnerable to privilege escalation via prototype pollution in ESXi import methods, allowing authenticated users to gain global administrator rights.

A parsing discrepancy between tree-sitter-bash and the bash shell in Mistral Vibe allows attackers to bypass permission validation via backslash-newline line continuations to execute arbitrary commands.

The Sarcoma ransomware-as-a-service group continues to target mid-market organizations globally, recently exfiltrating 1.2 TB of data from a new victim in the United States.

A high-severity remote code execution vulnerability (CVE-2026-70197) in .NET allows unauthenticated out-of-bounds writes on Windows when reusing SocketAsyncEventArgs across IPv4 and IPv6 datagram sockets.

A spoofing vulnerability in the .NET System.Security.Cryptography.Xml library allows for certificate forgery and token spoofing via improper validation of KeyInfoX509Data serialized certificate formats.

A heap out-of-bounds vulnerability in the .NET WPF runtime allows attackers to achieve remote code execution through crafted pixel-shader bytecode.

An elevation of privilege vulnerability in the Microsoft.AspNetCore.Authentication.Negotiate package allows an attacker to misassociate an authenticated identity with an unintended LDAP principal due to improper validation of Kerberos principal SIDs.

An unencoded exception reflection vulnerability in the Blazor WebAssembly development server allows remote attackers to perform cross-site scripting (XSS) via the unauthenticated /_framework/debug endpoint.

The U.S. FBI and CrowdStrike disrupted domestic laptop farms operated by the DPRK-nexus actor FAMOUS CHOLLIMA to conduct employment fraud and gain persistent access to victim organizations.

Citrix has released security bulletins addressing multiple vulnerabilities across UniconOS and XenServer products, including CVE-2026-53562, CVE-2026-53563, CVE-2026-53564, CVE-2026-79610, CVE-2026-102700, and CVE-2026-102701.

Roundup of Adobe security advisories published in October 2026.

The odt2spip plugin for SPIP before 4.4.0 is vulnerable to OS command injection, allowing authenticated authors to execute arbitrary commands during document conversion.

The fuint platform contains a missing authentication vulnerability in the /clientApi/order/detail endpoint, allowing unauthenticated attackers to retrieve sensitive customer order PII via enumeration.

An insecure direct object reference vulnerability in FastBee versions through 2.1.0 allows authenticated low-privileged users to access and modify devices belonging to other tenants.

Makunet maku-boot versions 4.3.0 through 5.0.0 suffer from a missing authorization vulnerability, enabling authenticated users to exfiltrate cloud service credentials and send unauthorized emails.

Yshopmall through version 2.0.0 contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated members to access, modify, or delete the shipping addresses of other users.

Risesoft Digital-Infrastructure versions 9.6.5 through 9.6.11 contain a path traversal vulnerability in the fileManager component, allowing unauthenticated attackers to read sensitive files via the /rest/retrieveFileStream endpoint.

MateCloud versions 5.0.8 and earlier contain an authorization bypass vulnerability (CVE-2026-110108) allowing authenticated users to perform unauthorized administrative object storage operations.

Powerlevel10k versions through 1.20.0 execute malicious code via an insecure gitstatus installation script that disables TLS certificate verification and lacks integrity checks.

Ikaros versions 1.2.0 through 1.2.5 are vulnerable to an authentication bypass where attackers with valid passwords can circumvent TOTP requirements by manipulating temporary login tokens.

A remote SQL injection vulnerability in SourceCodester Online Reviewer System 1.0 allows attackers to execute arbitrary SQL commands via the login endpoint.

SourceCodester Online Exam System 1.0 is vulnerable to unauthenticated remote SQL injection via the login endpoint, allowing potential authentication bypass.

AnyDesk contains a vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code with administrator privileges on affected Windows systems.

An unrestricted file upload vulnerability in the Extension Check component of phpwcms allows remote unauthenticated attackers to upload arbitrary files via the POST_name parameter.

SourceCodester Simple Cafe Billing System 1.0 is vulnerable to an improper authorization flaw in the User Management component that allows remote attackers to manipulate the 'Type' argument during user saving operations.

An unauthenticated SQL injection vulnerability in the Online-Appointment-Booking-System Admin CRUD endpoint allows remote attackers to execute arbitrary SQL commands via the cid or did parameters.

IBM WebSphere Application Server versions 8.5 and 9.0 are vulnerable to an authentication bypass in the CSIv2 inbound propagation handler, potentially allowing remote unauthorized access.

Serena versions prior to 2.0.0 contain a path traversal vulnerability in Project.is_path_in_project() that allows attackers to access sensitive files outside the project root via malicious symlinks.

Froxlor versions 2.0.0 through 2.3.13 are vulnerable to stored cross-site scripting (XSS) via the customer theme setting, allowing authenticated customers to compromise administrator sessions.

NLTK versions up to 3.10.3 contain a path traversal vulnerability in the WekaClassifier component that allows attackers to probe or write files outside of defined data roots.

CVE-2026-109520 is a local privilege escalation vulnerability in Colorful iGameCenter 2.0.0.82 allowing unauthorized actions via manipulated IOCTL requests to the AMDRyzenMasterDriver.sys driver.

YouTransfer versions up to 0.0.7, 1.0.6, and 1.1.0 contain a path traversal vulnerability in the Template Rendering component that allows remote, unauthenticated file access.

An SSRF vulnerability in the Conductor-OSS A2AService allows remote attackers to manipulate the agentUrl parameter to force unauthorized internal requests.

Multiple vulnerabilities in Siemens SIMATIC S7 products enable unauthenticated or local attackers to execute arbitrary code, escalate privileges, manipulate data, or cause a denial-of-service.

The Biletiva Ticketing Platform is vulnerable to client-side enforcement of server-side security, allowing unauthorized state manipulation via crafted client-side requests.

An authentication bypass vulnerability in the AdithyaYelloju Restaurant-Management-System allows remote attackers to gain unauthorized access via manipulated login credentials.

Roundup of Siemens security advisories published in October 2026.

An unauthenticated stored XSS vulnerability in AcyMailing WordPress plugin version 11.1.0 and earlier allows attackers to inject malicious scripts via the customField[] parameter.

The Bit Integrations plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via improper input sanitization in the notification_content parameter, allowing script injection when specific BuddyBoss notification flows are active.

SourceCodester Library Management System 1.0 is vulnerable to an unrestricted file upload flaw via the 'image' argument in 'admin/add_admin.php', potentially enabling remote code execution.

SourceCodester E-Learning System 1.0 contains an unrestricted file upload vulnerability in the save_users function, allowing remote attackers to upload arbitrary files to the server.

SourceCodester Contact Tracing System 1.0 is vulnerable to an unrestricted file upload flaw in the /classes/Users.php component, allowing remote attackers to achieve arbitrary file uploads.

A vulnerability in SourceCodester Human Resource Management System 1.0 allows remote attackers to bypass authentication through input manipulation in the session_start function.

An authentication bypass vulnerability in the Online-Examination-System Session Handler allows remote attackers to gain unauthorized access via incorrect comparison of session cookies.

SourceCodester Performance Indicator System 1.0 contains an unauthenticated SQL injection vulnerability via the prodcategory parameter, allowing remote attackers to execute arbitrary SQL queries.

CVE-2025-9267 is a DLL hijacking vulnerability in Seagate Toolkit installer versions prior to 2.35.0.6, allowing local attackers to achieve SYSTEM-level privilege escalation.

An integer overflow in the OpenS100 S-102 parser allows remote attackers to trigger heap-based buffer overflows and potential arbitrary code execution via malicious HDF5 metadata.

Roundup of SAP security advisories published in October 2026.

IBM Planning Analytics versions 2.0 and 2.1 are vulnerable to an improper functional level access control flaw, enabling remote authenticated attackers to delete folders and applications belonging to other users.

An unauthenticated SQL injection vulnerability in phpMyFAQ versions prior to 4.1.9 allows attackers to exfiltrate data and manipulate database records by injecting Unicode characters into the api/autocomplete endpoint.

IBM TRIRIGA Application Platform versions 5.0.0 through 5.0.8 contain a path traversal vulnerability during archive extraction that allows remote authenticated attackers to execute arbitrary code.

Frappe ERPNext versions before 14.92.1 and 15.x before 15.83.0 are susceptible to reflected XSS, allowing unauthenticated attackers to execute arbitrary JavaScript in authenticated sessions.

Frappe versions 14.x and 15.x contain a privilege management vulnerability allowing authenticated Website Users to escalate to System Manager privileges via document action manipulation.

IBM Power Systems Firmware versions FW1060.00 through FW1060.81 contain a configuration parsing vulnerability that allows authenticated attackers to cause memory corruption and boot stack crashes.

An authentication flaw in the Netherman Portal del Hermano password-recovery flow allows attackers to perform account takeovers by exploiting rate-limit gaps and error-message oracles.

IBM Maximo Application Suite Location Service for Esri Component versions 9.0, 9.1, and 9.2 are vulnerable to improper access control due to a schema-less Custom Resource Definition, potentially allowing unauthorized access.

CVE-2026-109569 is a container escape vulnerability in sandboxed.sh versions up to 1.3.0, allowing containerized code to bypass isolation and access the host filesystem via misconfigured nsenter calls.

Shaark versions 1.2.13 through 1.2.44 contain a missing authorization vulnerability in multiple API controllers, allowing authenticated non-admin users to modify or delete content belonging to other users.

Continue CLI versions up to 1.5.47 are vulnerable to a command injection flaw that allows attackers to execute arbitrary commands by chaining them after permitted shell commands.

EdgeEver versions 1.112.0 and earlier contain a stored XSS vulnerability in the setMemoDragPreview function that allows for session token theft via malicious notebook or memo titles.

EdgeEver Desktop versions 1.92.0 through 1.112.0 contain a remote code execution vulnerability in the desktop:acp-probe IPC handler that allows arbitrary command execution via an insecure probeAcpAdapter function.

Telegram-Stremio versions 5.1.0 and earlier store Telegram session strings using a reversible encoding transform, enabling attackers with database or log access to perform full account takeover.

IBM Maximo Application Suite versions 8.10 through 9.2 are susceptible to unauthenticated directory traversal, allowing remote attackers to read arbitrary files via crafted URL requests.

The fast-toml library up to version 0.5.4 is vulnerable to prototype pollution, allowing attackers to modify Object.prototype through crafted TOML input, potentially leading to denial of service or authorization bypass.

Servor versions 1.0.0 through 4.0.2 are vulnerable to path traversal via URL-encoded dot segments, allowing unauthenticated attackers to read arbitrary files and list directories.

The easy-pdf-merge package (versions 0.1.0 through 0.2.6) contains an OS command injection vulnerability via unsanitized input to child_process.exec(), allowing arbitrary code execution.

NetEase Cloud Music versions 3.1.38 and 3.1.39.205426 are vulnerable to remote code execution due to improper validation of URL schemes in the IPC bridge, allowing arbitrary local binary execution via API response forgery.

A fail-open vulnerability in openstack-network-exporter allows adjacent network attackers to bypass authentication and exfiltrate sensitive OVS and OVN dataplane metrics when TLS is not properly configured.

IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.5 contain an improper privilege management vulnerability allowing local users to escalate privileges.

Contrast versions 1.8.0 through 1.24.0 are vulnerable to an improper verification flaw in the Coordinator peer recovery process that allows manifest history replay and potential Mesh CA key disclosure.

Network-AI versions 5.14.0 through 5.15.1 contain a security control bypass in the ClaudeHookBridge PreToolUse hook, enabling prompt-injected agents to execute arbitrary scripts or deploy web shells.

An unauthenticated access vulnerability in ZITADEL versions 3.0.0 through 4.17.x allows remote attackers to rename arbitrary user accounts via the change-username handler, resulting in administrative account lockout.

MONAI versions prior to 1.6.1 are vulnerable to remote code execution due to insecure deserialization of pretrained weights fetched over plaintext HTTP.

Edgeless Systems Contrast versions 1.8.0 through 1.24.0 contain a world-writable containerd configuration file vulnerability, allowing local unprivileged users to achieve privilege escalation.

LibreNMS versions prior to 26.9.0 are vulnerable to LDAP filter injection, allowing unauthenticated attackers to bypass authentication and gain administrative access via crafted HTTP Basic Authorization headers.

Adminer versions prior to 6.1.1 are vulnerable to remote code execution (RCE) where authenticated SQLite users can bypass security restrictions using UTF-8 byte-order marks to inject and execute PHP code.

The better-auth library's deviceAuthorization plugin fails to display client_id and scope information, enabling attackers to deceive authenticated users into authorizing malicious device codes.

SurrealDB versions prior to 3.3.0 are vulnerable to an authorization bypass that allows users with table-level write permissions to leak restricted field data through manipulated JSON Patch operations.

Grav versions 2.0.22 through 2.1.6 are vulnerable to an authentication bypass in the Clockwork profiler that trusts loopback REMOTE_ADDR headers, potentially exposing system configuration and secrets.

Grav Git Sync versions 1.0.2 through 3.4.12 contain a command injection vulnerability allowing authenticated users to execute OS commands via malicious profile inputs.

A privilege escalation vulnerability (CVE-2026-109317) in the Grav grav-plugin-api plugin before version 1.0.36 allows users with delegated management permissions to obtain super-admin access.

Craft CMS versions 5.10.2 through 5.10.13 contain a Twig sandbox bypass vulnerability allowing non-admin users with System Messages permissions to execute arbitrary PHP code.

Open WebUI versions 0.7.0 through 0.11.3 contain a cross-origin message handling vulnerability that allows unauthenticated websites to steal a user's session JWT via a crafted postMessage payload.

FreeRDP versions before 3.0.0 and 3.6.0 before 3.32.0 are vulnerable to heap memory disclosure and denial-of-service attacks triggered by a malicious RDP server sending crafted progressive tile sequences.

SWUpdate through 2026.05.1 is vulnerable to certificate validation bypass in crypto/swupdate_cms_verify_openssl.c, allowing attackers to sign and install malicious update packages.

An unrestricted file upload vulnerability in Thelia allows authenticated back-office users to achieve remote code execution by bypassing filename sanitization.

Thirty bees versions up to 1.7.0 are vulnerable to an authentication bypass in PasswordController::resolveCustomer() that enables account takeover via manipulated guest checkout processes.

Square Squash through commit e73f280 is vulnerable to insecure deserialization via the /api/1.0/symbolication endpoint, allowing unauthenticated attackers to achieve arbitrary Ruby object deserialization and potential remote code execution.

Exponent CMS versions up to 3.0.2patch2 contain a SQL injection vulnerability in the userLogin function within xmlrpc.php that allows unauthenticated remote attackers to execute arbitrary SQL commands.

Zoraxy versions up to 3.3.4 are vulnerable to a remote authorization bypass in the Path Exception Matcher component that allows attackers to manipulate PathPrefix arguments.

A local privilege escalation vulnerability in Docker Desktop for Windows allows a local attacker to execute arbitrary code with administrative privileges.

CERT-FR reports widespread compromises of Danfoss AK-SM and AK-SC series controllers resulting from the exposure of management interfaces directly to the internet.

CVE-2026-31694 is an out-of-bounds write vulnerability in the Linux kernel FUSE readdir implementation that allows local attackers to corrupt physically adjacent memory pages and achieve privilege escalation.

CVE-2024-21378 is a remote code execution vulnerability in Microsoft Outlook that enables attackers to execute arbitrary code by delivering a malicious email form containing a COM DLL.

The FIN7 threat group utilizes the Windows Management Instrumentation Command-line (WMIC) utility to execute arbitrary code by loading XSL files to bypass application whitelisting.

Snake malware achieves persistence by installing a rogue Windows service named 'WerFaultSvc' that masquerades within the Windows WinSxS directory.

Snake malware modifies the .wav\OpenWithProgIds registry path to facilitate the decryption of configuration blobs used by WerFault.exe to load malicious kernel drivers.

Snake Malware utilizes the creation of a specifically named file, 'comadmin.dat', within the system32\Com directory to facilitate the installation and loading of a malicious kernel driver for persistence and privilege escalation.

Attackers leverage legitimate Windows binaries like reg.exe and regedit.exe to export sensitive SAM, SECURITY, and SYSTEM hives for offline credential theft and lateral movement.

Adversaries modify SafeBoot registry keys to ensure malicious drivers or services execute during Safe Mode, enabling persistence and bypassing standard startup security.

Malware utilizes parent process spoofing by spawning an instance of explorer.exe with the /root command-line argument to evade security monitoring and obscure process lineage.

Detection of Hermetic Wiper malware activities involving the manipulation of Windows registry keys 'ShowCompColor' and 'ShowInfoTip' to alter file visibility and UI elements.

Detection of Windows Security Event ID 1102 or System Event ID 104 indicates an attempt to disrupt forensic logging and cover tracks after system compromise.

Adversaries leverage the Deployment Image Servicing and Management (DISM) tool to disable or remove Windows Defender components as a defense evasion technique.

The execution of the ConvertTo-AADIntBackdoor PowerShell cmdlet indicates an attempt to compromise Azure AD federation settings to enable unauthorized token generation and persistent access.

Adversaries manipulate undocumented registry keys under the NTDS service to load malicious DLLs into the Local Security Authority Subsystem Service (LSASS) for credential theft and persistence.

Attackers utilize the native Windows utility wbadmin.exe to delete system backups and catalogs as part of ransomware operations to impede victim recovery.

Adversaries utilize the fltMC.exe utility to unload the Sysmon filter driver, effectively blinding security monitoring and suppressing telemetry generation to facilitate further malicious activity.

Detection of rundll32.exe executing with 'Start' or 'StartW' function parameters, a common technique used by Cobalt Strike payloads to achieve arbitrary code execution and persistence.

This correlation identifies anomalous activity targeting Windows Certificate Services by aggregating multiple risk-based detections on a single system, signaling potential adversary efforts to forge or steal authentication certificates.