🚨 CVE-2026-53758
Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including <script> tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization, resulting in stored XSS visible to all site visitors. At time of publication, there are no publicly known patches.

🎖@cveNotify

🚨 CVE-2026-57161
PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing Service-Route headers in a registration response (update_service_route() in pjsua_acc.c). This affects applications that register using the PJSUA/PJSUA2 account API (the default registration path). The Service-Route URIs from a 2xx response to REGISTER are stored into a fixed-size array without bounding the number of headers; a registrar that returns an excessive number of Service-Route headers can write past the end of the array on the stack. The values written are internal pointers rather than arbitrary data, so the most likely impact is unexpected application termination (denial of service), though memory corruption cannot be excluded. The malicious response may come from a compromised or malicious registrar, or — over unprotected transports — a spoofed response. This issue has been patched via commit acc03b5.

🎖@cveNotify

🚨 CVE-2026-52772
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw('html') to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6.

🎖@cveNotify

🚨 CVE-2026-80164
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

🎖@cveNotify

🚨 CVE-2026-54611
InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (RCE) issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, it won't be installed, but upload files will be executed. Normally all php files in upload folder are not executed, however, by uploading custom .htaccess it becomes possible. Version 2.18.2 contains a fix.

🎖@cveNotify

🚨 CVE-2026-64918
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.

🎖@cveNotify

🚨 CVE-2026-69272
Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network.

🎖@cveNotify

🚨 CVE-2026-69277
Stack-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

🎖@cveNotify

🚨 CVE-2026-69321
Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally.

🎖@cveNotify

🚨 CVE-2026-69503
Stack-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges over a network.

🎖@cveNotify

🚨 CVE-2026-69581
Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

🎖@cveNotify

🚨 CVE-2026-69586
Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.

🎖@cveNotify

🚨 CVE-2026-69688
Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.

🎖@cveNotify

🚨 CVE-2026-69714
Stack-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges over a network.

🎖@cveNotify

🚨 CVE-2026-70573
Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

🎖@cveNotify

🚨 CVE-2026-83996
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

🎖@cveNotify

🚨 CVE-2026-87434
Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

🎖@cveNotify

🚨 CVE-2026-87442
Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

🎖@cveNotify

🚨 CVE-2026-87449
Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

🎖@cveNotify

🚨 CVE-2026-87461
Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted Chrome extension. (Chromium security severity: Low)

🎖@cveNotify

🚨 CVE-2026-87466
Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

🎖@cveNotify