CVE watch
Every disclosure pulled from the NVD feed, filterable by severity.
CVE-2026-75820 published: GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a...
Details →CVE-2026-75818 published: GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap...
Details →CVE-2026-75819 published: GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An...
Details →CVE-2026-105985 published: Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overr...
Details →CVE-2026-103831 published: CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in th...
Details →CVE-2026-84854 published: In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Und...
Details →CVE-2026-80327 published: An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0...
Details →CVE-2026-104405 published: Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
Details →CVE-2026-104406 published: Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
Details →CVE-2026-104670 published: Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
Details →CVE-2026-104672 published: Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
Details →CVE-2026-104747 published: Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
Details →CVE-2026-104757 published: Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
Details →CVE-2026-104387 published: Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
Details →CVE-2026-104394 published: Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
Details →CVE-2026-104395 published: Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
Details →CVE-2026-104399 published: Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.
Details →CVE-2026-100518 published: Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
Details →CVE-2026-102387 published: Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
Details →CVE-2026-102915 published: Subscriber Broken Access Control in WPO365 <= 44.1 versions.
Details →