🚨 CVE-2026-111609
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
🎖@cveNotify
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access.
🎖@cveNotify
GitHub
ojs/controllers/grid/subscriptions/IndividualSubscriptionForm.php at 3_5_0-5 · pkp/ojs
Open Journal Systems is open source software to manage scholarly journals. - pkp/ojs
🚨 CVE-2026-112202
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images.
With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected.
The same code ships bundled in the Imager distribution.
An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.
🎖@cveNotify
Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images.
With `gif_consolidate => 1`, palette indices from the image are used without checking the colour table's bounds. The i_readgif_low routine reads beyond the heap allocation and copies the bytes into output pixels. The default GIF reader is not affected.
The same code ships bundled in the Imager distribution.
An attacker supplying a crafted GIF can disclose adjacent heap memory through the decoded output and may crash the process.
🎖@cveNotify
🚨 CVE-2026-96652
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
🎖@cveNotify
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
🎖@cveNotify
🚨 CVE-2026-96654
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
🎖@cveNotify
Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
🎖@cveNotify
❤1
🚨 CVE-2026-96655
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
🎖@cveNotify
Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
🎖@cveNotify
🚨 CVE-2026-96656
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
🎖@cveNotify
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
🎖@cveNotify
🚨 CVE-2026-106173
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.
🎖@cveNotify
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.
🎖@cveNotify
FortiGuard Labs
PSIRT | FortiGuard Labs
None
🚨 CVE-2026-106931
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
🎖@cveNotify
SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
🎖@cveNotify
jvn.jp
JVN#88474777: SiteGuard Server Edition vulnerable to OS command injection
Japan Vulnerability Notes
🚨 CVE-2026-110936
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
🎖@cveNotify
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
🎖@cveNotify
🚨 CVE-2026-76740
A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.
🎖@cveNotify
A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be exploited remotely to execute arbitrary commands on the RMC.
🎖@cveNotify
🚨 CVE-2026-105453
IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.
🎖@cveNotify
IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privileges due to improper privilege management.
🎖@cveNotify
Ibm
Security Bulletin: IBM Sterling Connect:Direct for Unix is impacted by a vulnerability
The statistics file archive feature is used by IBM Sterling Connect:Direct for UNIX to automatically archive statistics files. IBM Sterling Connect:Direct for UNIX is impacted by a vulnerability in the statistics file archive feature. IBM Sterling Connect:Direct…
🚨 CVE-2026-107366
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversation session by reassigning its session ID.
🎖@cveNotify
Ibm
Security Bulletin: Langflow OSS is affected by multiple vulnerabilities
Langflow OSS is affected by multiple vulnerabilities involving remote code execution and security scanner controls. Depending on the affected feature and deployment configuration, an authenticated attacker could bypass component security scanning, inject…
🚨 CVE-2026-28853
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.
🎖@cveNotify
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to elevate privileges.
🎖@cveNotify
🚨 CVE-2026-84579
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Opening a file referencing a network share may lead to unexpected software execution.
🎖@cveNotify
A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Opening a file referencing a network share may lead to unexpected software execution.
🎖@cveNotify
🚨 CVE-2026-86919
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.
🎖@cveNotify
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. An attacker with a paired Bluetooth device may be able to execute arbitrary code.
🎖@cveNotify
🚨 CVE-2026-86922
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.
🎖@cveNotify
A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Processing maliciously crafted web content may lead to arbitrary code execution.
🎖@cveNotify
🚨 CVE-2026-86948
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.
🎖@cveNotify
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox.
🎖@cveNotify
Apple Support
About the security content of Xcode 27 - Apple Support
This document describes the security content of Xcode 27.
🚨 CVE-2026-86949
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.
🎖@cveNotify
This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A malicious app may be able to break out of its sandbox.
🎖@cveNotify
Apple Support
About the security content of Xcode 27 - Apple Support
This document describes the security content of Xcode 27.
🚨 CVE-2026-86961
A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.
🎖@cveNotify
A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicious app may be able to break out of its sandbox.
🎖@cveNotify
🚨 CVE-2026-102438
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.
Refer to the '
Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
🎖@cveNotify
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process.
Refer to the '
Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information.
🎖@cveNotify
Asus
ASUS Security Advisory | Latest Vulnerability Update
Stay updated with ASUS security advisories, firmware patches, and vulnerability reports. Learn how to protect your devices and report issues.
🚨 CVE-2026-12489
An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to escalate privileges by modifying the login_privilege data on an affected device.
🎖@cveNotify
An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could allow an authenticated attacker to escalate privileges by modifying the login_privilege data on an affected device.
🎖@cveNotify
Zyxel
Zyxel security advisory for incorrect authorization vulnerability in the DAL of certain 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs…
CVE: CVE-2026-12489 Summary Zyxel has released patches for specific firmware versions of certain 5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and Wireless Extenders to address an incorrect authorization vulnerability in the Data Access Layer (DAL). Users are…