Vulnerabilities
X.Org Server Glamor CopyArea Heap Overflow Allows Local Privilege Escalation
A heap-based buffer overflow in X.Org Server lets local attackers escalate to root; a patch is available for affected installations.
Vuln Post Vulnerability Desk
Vulnerabilities
Vulnerabilities
X.Org Server Patch Fixes Local Info Leak in XKB Map Handling
A confirmed update addresses an out-of-bounds read in X.Org Server that could allow local attackers to access sensitive system data.
Vulnerabilities
Leantime JSON-RPC Flaw Lets Users Escalate to Admin in Versions Below 3.10.0
A high-severity authorization bypass in Leantime allows any authenticated user to create admin accounts or manage plugins. Version 3.10.0 patches the issue.
Vulnerabilities
HTTP Headers Enable Indirect Prompt Injection in AI Agents via 30 Sites
Researchers found dozens of sites using HTTP headers to inject malicious instructions into AI agents, though most attempts were harmless pranks.
Vulnerabilities
Linux KVM CVE-2026-99999 Critical Flaw Enables Guest VMs to Corrupt Host Memory in Versions 4.4-6.18
A critical kernel flaw in Linux networking code allows guest VMs to corrupt host memory, affecting KVM hypervisors running versions 4.4 through 6.18.
Vulnerabilities
ILIAS PHP Object Injection Flaw Lets Authenticated Users Run Code
A high-severity vulnerability in ILIAS allows attackers with test permissions to execute arbitrary code via crafted archives.
Vulnerabilities
Markdown Preview Enhanced Fixes Remote Code Execution in VS Code Extension
A high-severity command injection flaw in the Markdown Preview Enhanced extension allows attackers to run system commands via crafted links, now patched in version 0.8.28.
Vulnerabilities
WeGIA Session Flaw Lets Attackers Hijack Accounts and Leak DB Host
A vulnerability in WeGIA below version 3.8.6 allows session hijacking and internal host disclosure, with a patch now available for deployment.
Vulnerabilities
OpenAEV Patch Fixes Unauthenticated Access to Adversary Simulation Data
A high-severity flaw in OpenAEV allows unauthenticated users to read and modify exercise data. Version 2.260622.0 provides a fix for the authentication bypass.
Vulnerabilities
FileRise WebDAV Bypass Allows Login Without TOTP in Versions Before 3.16.0
A high-severity flaw in FileRise lets attackers bypass two-factor authentication on the WebDAV service using only primary credentials.
Vulnerabilities
GitPython Argument Injection in Head.checkout() Allows Arbitrary File Read Before 3.2.0
Versions of the GitPython library prior to 3.2.0 contain a high-severity argument injection flaw that lets attackers read local files via malicious branch names.
Vulnerabilities
MoviePilot Command Injection Flaw Allows Remote Code Execution
A high-severity flaw in MoviePilot through 3.1.5 lets attackers run system commands via crafted content, with no patch confirmed yet.
Vulnerabilities
Ellucian WebAdvisor 3.2 Has High-Severity Unauthenticated XXE Flaw
An unpatched XML injection flaw in Ellucian WebAdvisor 3.2 allows remote attackers to steal credentials and read files. No fix exists.
Vulnerabilities
Eclipse Vert.x PostgreSQL Client Has High-Severity Memory Exhaustion Flaw
A missing validation check in the PostgreSQL message decoder allows malicious servers to crash clients before authentication completes.
Vulnerabilities
Slican IPx Phone Systems Patch Plaintext Password Storage Flaw
Slican released a version update for IPx telephone exchanges to fix a high-severity flaw that stored subscriber passwords in readable text.
Vulnerabilities
AWS Load Balancer Controller 3.4.2 Fixes Misordered HTTP/gRPC Route Precedence CVE
Version 3.4.2 resolves CVE-2026-15738, which allowed users to intercept traffic via misordered HTTP and gRPC routes on shared gateways.
Vulnerabilities
SQL Injection in CP Multi View Event Calendar Affects WordPress Sites
A high-severity SQL injection flaw in the CP Multi View Event Calendar plugin affects versions through 1.4.41, with no confirmed patch status in the record.
Vulnerabilities
TLS Libraries Skip Name Constraint Checks in GnuTLS, wolfSSL, OpenSSL
CERT/CC details thirteen flaws where TLS libraries inconsistently enforce X.509 name constraints, allowing potential namespace bypasses.
Vulnerabilities
Amazon S3 Encryption Client for .NET Patched for RSA Padding Downgrade Flaw CVE-2026-110310
Security teams must upgrade Amazon S3 Encryption Client for .NET to patch CVE-2026-110310, which allows attackers to decrypt data via legacy padding downgrades.
Vulnerabilities
Diaple Stela Cookie Manipulation Grants Unauthenticated Super Admin Access in Pre-1.60.1 Versions
Diaple Stela versions prior to 1.60.1 contain a critical flaw allowing remote attackers to bypass login checks and gain full administrative access without credentials.
Vulnerabilities
Dokku RCE Risk: Unsafe Bash Eval in Docker Options Patched in 0.38.25
A critical flaw in Dokku versions before 0.38.25 allows remote code execution via the docker-options plugin, but a patch is now available.
Vulnerabilities
SQL Server Heap Overflow CVE-2026-68883 Lets Authenticated Attackers Escalate Privileges Remotely
Microsoft details a high-severity heap overflow in SQL Server versions up to 2022 that allows authorized attackers to elevate privileges over networks.
Vulnerabilities
SharePoint Server Access Control Bug Lets Network Attackers Escalate Privileges
Microsoft SharePoint Server Subscription Edition contains a network-accessible flaw that allows authorized attackers to gain higher privileges.
Vulnerabilities
Windows Media Video Decoder Heap Buffer Overflow CVE-2026-100220 Demands Urgent Patching for Windows 10/11 Users
A high-severity flaw in the Windows Media Video Decoder allows remote code execution. Affected Windows 10 and 11 versions require immediate updates.