🔴 CVE-2026-78188
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.
WebDyne::Session sets its session cookie with only a name, value and path
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes.
WebDyne::Session sets its session cookie with only a name, value and path
🔴 CVE-2026-78189
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback.
When a request matches no file, the PSGI handler retr
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback.
When a request matches no file, the PSGI handler retr
🔴 CVE-2026-120199
LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another u
LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another u
🔴 CVE-2026-120200
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes.
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes.
🔴 CVE-2026-120201
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TO
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TO
🔴 CVE-2026-115946
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.
Affected versions compile a bundled brotli into static archives that dependent XS mo
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder.
Affected versions compile a bundled brotli into static archives that dependent XS mo
🔴 CVE-2026-120189
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function saveuploadfile/mpuploadfile of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipul
A vulnerability was identified in D-Link DIR-505 1.10B02. Affected is the function saveuploadfile/mpuploadfile of the file /usr/bin/tftpd of the component TFTP Upload Filename Handler. The manipul
🔴 CVE-2026-120190
A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/Des
A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-forms/form-components/Des
🔴 CVE-2026-107342
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relyin
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email handler resolves and returns a user's email address, relyin
🔴 CVE-2026-107343
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any log
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check on its test-email handler, relying only on a nonce that is available to any log
🔴 CVE-2026-113481
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authe
The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a post before disclosing which taxonomy terms are assigned to it, allowing any authe
🔴 CVE-2026-120237
A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the compone
A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the compone
🔴 CVE-2026-120238
A vulnerability has been found in WAVLINK WN553X1-B 2604032.0.0. This affects the function sub4162A8 of the file /bin/ioos of the component ovpnfile Handler. Such manipulation of the argument file
A vulnerability has been found in WAVLINK WN553X1-B 2604032.0.0. This affects the function sub4162A8 of the file /bin/ioos of the component ovpnfile Handler. Such manipulation of the argument file
🔴 CVE-2026-120239
A vulnerability was found in WAVLINK WN553X1-B V2604032.0.0. This vulnerability affects the function sub419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation
A vulnerability was found in WAVLINK WN553X1-B V2604032.0.0. This vulnerability affects the function sub419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation