CVE Notifier

CVE-2026-13684 CWE-116 9.8

CVE-2026-13684

An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary …

cve.org Synology:DiskStation · Manager · (DSM) 2 hari lalu

CVE-2026-11757 CWE-79 6.1

Reflected XSS in KA Informatics' Bar Association Website

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in KA Informatics Technologies Ltd. Co. Bar Association Website allows Reflected XSS. This issue affects Bar Association…

cve.org KA · Informatics · Technologies 2 hari lalu

CVE-2026-93493 CWE-299 5.9

Io.netty/netty-handler-ssl-ocsp: netty: ocsp validation silently skipped when a response omits the optional nextupdate field

A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP) response that omits the optional `nextUpdate` fie…

cve.org Red · Hat:Red · Hat 2 hari lalu

CVE-2026-67103 CWE-79 7.6

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by Cross-Site Scripting (XSS) vulnerability, which could allow an attacker to inject unsanitized malicious scripts that execute in a victim's browser, enabling session hijacking,…

cve.org HCL · Software:HCL · BigFix 2 hari lalu

CVE-2026-67102 CWE-285 8.1

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a high-severity Broken Access Control vulnerability, which could allow a low-privileged user to gain unauthorized access to administrative screens and functions reserved for h…

cve.org HCL · Software:HCL · BigFix 2 hari lalu

CVE-2026-67100 CWE-89 9.8

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system d…

cve.org HCL · Software:HCL · BigFix 2 hari lalu

CVE-2026-75157 CWE-863 N/A

Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset eve…

cve.org Apache · Software · Foundation:Apache 2 hari lalu

CVE-2026-67101 CWE-918 9.3

HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal syst…

cve.org HCL · Software:HCL · BigFix 2 hari lalu

CVE-2026-12384 CWE-639 8.8

Broken Access Control in TECHIN2B Application

Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse. This issue affects TECHIN2B Application: from V1.0.7676.13 through 18092026. NOTE: The vendor was c…

cve.org TECHIN2B:TECHIN2B · Application 2 hari lalu

CVE-2026-92249 CWE-79 6.1

Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping…

Wordfence qodeinteractive:Qi · Addons · For 2 hari lalu

CVE-2026-85705 CWE-89 7.5

Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user su…

Wordfence AyeCode · Ltd:Location · Manager 2 hari lalu

CVE-2026-85652 CWE-89 6.5

Photo Gallery by 10Web <= 1.8.44 - Authenticated (Author+) SQL Injection via 'album_id' Shortcode Attribute

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up to, and including, 1.8.44 due to insufficien…

Wordfence 10web:Photo · Gallery · by 2 hari lalu