CVE-2026-102703
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] A common access pattern is a batch of Grant Copy operations acting…
CVE-2026-104799
The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST…
CVE-2026-114456
Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in…
CVE-2026-121925
A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication.
CVE-2026-77779
ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized…
CVE-2026-85036
The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_l2cap_disconnected() in subsys/bluetooth/host/classic/avdtp.c ends with…
CVE-2026-87038
The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in drivers/i3c/i3c_handlers.c, validated the caller-supplied struct i3c_device_desc in place instead of…
CVE-2026-87043: Fallo de generación de números aleatorios en el kernel
Una vulnerabilidad de lectura de memoria no inicializada en el generador de entropía puede exponer datos sensibles y degradar la seguridad de protocolos de red.
CVE-2026-87044
The Mbed TLS crypto shim driver in drivers/crypto/crypto_mbedtls_shim.c drives PSA multipart cipher and AEAD operations.
CVE-2026-97397
The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output…
CVE-2026-102435
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and…
CVE-2026-105978
Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.
CVE-2026-105979
Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges.
CVE-2026-105981
Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.
CVE-2026-107441
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and…
CVE-2026-108052
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
CVE-2026-108053
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
CVE-2026-108054
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
CVE-2026-108055
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
CVE-2026-108059
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.