CVE Notifier

CVE-2026-93575 CWE-1035 7.5

Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length…

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2026-93561 CWE-1035 6.5

Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious M…

cve.org Red · Hat:Red · Hat 1 hari lalu

CVE-2026-92976 CWE-613 N/A

Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0

A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user could inject malicious HTML or JavaScript content into the fields containing th…

cve.org T-Systems:TAO 1 hari lalu

CVE-2026-87743 CWE-551 7.5

Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security

A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a …

cve.org Red · Hat:Exploit · Intelligence 1 hari lalu

CVE-2026-15579 CWE-787 N/A

CVE-2026-15579

An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially…

cve.org Moxa:TN-4500B · Series 1 hari lalu

CVE-2026-87915 CWE-79 7.2

Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via values[Name] Parameter in all versions up to, and i…

Wordfence danieliser:Popup · Maker · – 1 hari lalu

CVE-2026-15797 CWE-79 6.4

Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title

The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post_title in all versions up to, and including, 1.…

Wordfence danieliser:Popup · Maker · – 1 hari lalu

CVE-2026-90884 CWE-79 5.4

WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. Thi…

Wordfence brechtvds:WP · Recipe · Maker 1 hari lalu

CVE-2026-18405 CWE-79 7.2

Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.2…

Wordfence jegtheme:Jeg · Kit · for 1 hari lalu

CVE-2026-21822 CWE-22 6.3

A path traversal vulnerability has been identified in HCL AppScan 360° (CVE-2026-21822).

HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended direc…

cve.org HCL · Software:HCL · AppScan 2 hari lalu

CVE-2026-40539 CWE-295 7.1

CVE-2026-40539

An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows man-in-the-middle attackers to read or write arbitrary fil…

cve.org Synology:DiskStation · Manager · (DSM) 2 hari lalu

CVE-2026-40538 CWE-307 3.7

CVE-2026-40538

An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to read limite…

cve.org Synology:DiskStation · Manager · (DSM) 2 hari lalu