🔴 CVE-2026-112605
This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files.
This issue was addressed with improved handling of symlinks. This issue is fixed in Xcode 27.2. An app may be able to read arbitrary files.
🔴 CVE-2026-114422
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthentica
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthentica
🔴 CVE-2026-114443
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, all
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, all
🔴 CVE-2026-114444
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tr
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tr
🔴 CVE-2025-68391
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability
🔴 CVE-2025-68392
ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.
This issue ha
ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.
This issue ha
🔴 CVE-2025-68393
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "Utilisateur" parameter allows fo
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "Utilisateur" parameter allows fo
🔴 CVE-2025-8574
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be del
The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be del
🔴 CVE-2026-102905
The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing use
The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.8.19 This is due to the software allowing use
🔴 CVE-2026-117656
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via
Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unauthenticated remote attacker to impersonate another user via
🔴 CVE-2026-77152
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity.
The acces
Improper Authorization vulnerability in Drupal Field Collection for Drupal 7 allows a user with the "edit field collections" permission to bypass access control on the parent (host) entity.
The acces
🔴 CVE-2026-110176
The File Force Download module for Drupal 7 implements hookfiledownload() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty
The File Force Download module for Drupal 7 implements hookfiledownload() to add a Content-Disposition header when a file URL carries the download query parameter. In Drupal 7, returning a non-empty
🔴 CVE-2026-15272
The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dclevelfilter' parameter in all versions up to, and including, 2.10.12 due to insufficient escaping on
The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dclevelfilter' parameter in all versions up to, and including, 2.10.12 due to insufficient escaping on
🔴 CVE-2026-78188
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.
WebDyne::Session sets its session cookie with only a name, value and path
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.
WebDyne::Session sets its session cookie with only a name, value and path
🔴 CVE-2026-78189
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback.
When a request matches no file, the PSGI handler retr
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback.
When a request matches no file, the PSGI handler retr
🔴 CVE-2026-120199
LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another u
LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another u
🔴 CVE-2026-120200
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes.
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes.
🔴 CVE-2026-120201
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TO
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TO
🔴 CVE-2026-115946
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.
Affected versions compile a bundled brotli into static archives that dependent XS mo
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.
Affected versions compile a bundled brotli into static archives that dependent XS mo
🔴 CVE-2026-120189
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function saveuploadfile/mpuploadfile of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipul
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function saveuploadfile/mpuploadfile of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipul
🔴 CVE-2026-120190
A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/Des
A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/Des