🚨 CVE-2026-61407
Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.
🎖@cveNotify
Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.
🎖@cveNotify
🚨 CVE-2026-63639
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
🎖@cveNotify
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when one consumer is deleted while another still references the shared NACK and potentially allowing remote code execution. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.
🎖@cveNotify
GitHub
fix: Reject corrupt stream RDB with shared NACK across consumers (#4073) · valkey-io/valkey@06bc776
When loading a stream consumer group from RDB, the loader assigns each
NACK's consumer pointer without checking if it was already set. A
corrupt RDB payload can list the same message ID und...
NACK's consumer pointer without checking if it was already set. A
corrupt RDB payload can list the same message ID und...
🚨 CVE-2026-66046
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
🎖@cveNotify
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
🎖@cveNotify
GitHub
[CVE-2026-66046] lib: Migrate `.isCdata` lookup from a linear loop to a hash table lookup by hartwork · Pull Request #1321 · l…
Everything after the next line is the original report Markdown from @fabwa…
Quadratic CPU Complexity in storeAtts() isCdata Attribute Default Lookup
Package: libexpat/libexpat
Tested Versions: 2.8...
Quadratic CPU Complexity in storeAtts() isCdata Attribute Default Lookup
Package: libexpat/libexpat
Tested Versions: 2.8...
🚨 CVE-2026-66627
Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion.
This issue affects GP Premium: from n/a through 2.5.5.
🎖@cveNotify
Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion.
This issue affects GP Premium: from n/a through 2.5.5.
🎖@cveNotify
Patchstack
Arbitrary File Upload in WordPress GP Premium Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66633
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Fluent Forms Pro Add On Pack Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66634
Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.
🎖@cveNotify
Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.
🎖@cveNotify
Patchstack
Insecure Direct Object References (IDOR) in WordPress Modal Survey Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66637
Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Featured Video Plus Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66638
Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Frontend Admin by DynamiApps Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66640
Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Login With Ajax Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66641
Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Video Conferencing with Zoom Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66643
Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Wufoo Shortcode Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66644
Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Typing Effect Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66645
Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Table Of Contents Block Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66646
Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress WP Tab Widget Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66667
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Templately Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-66679
Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.
🎖@cveNotify
Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Appointment Hour Booking Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-68565
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
🎖@cveNotify
Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress GeoDirectory Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2026-68567
Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.
🎖@cveNotify
Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Convert Pro Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.