CVE watch

CVE-2026-105835 published: PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token t...

CVE-2026-105836 published: QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id_r...

CVE-2026-56596 published: HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior.

CVE-2026-105918 published: A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/p...

CVE-2026-75820 published: GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a...

CVE-2026-75818 published: GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap...

CVE-2026-75819 published: GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An...

CVE-2026-105985 published: Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overr...

CVE-2026-103831 published: CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in th...

CVE-2026-84854 published: In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Und...

CVE-2026-80327 published: An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0...

CVE-2026-104405 published: Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.

CVE-2026-104406 published: Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

CVE-2026-104670 published: Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

CVE-2026-104672 published: Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

CVE-2026-104747 published: Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.

CVE-2026-104757 published: Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.

CVE-2026-104387 published: Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

CVE-2026-104394 published: Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

CVE-2026-104395 published: Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.