@euvd-bot.bsky.social🚨 EUVD-2026-100839 📊 6.5/10 🏢 Qt 📝 A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite using the public Qul:... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100839 #cybersecurity #infosec #cve #euvd
@stackflag.bsky.socialCVE-2026-106619 - coldfusion 2025
The 2023 and 2025 versions of Adobe ColdFusion may allow a malicious user to make the server run their own code, even if nobody clicks anything. This can give the…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-106624 - coldfusion 2025
Both the 2025 and 2023 versions of Adobe ColdFusion can be tricked into running whatever code an attacker provides. This can happen without any user clicking anything…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-106621 - coldfusion 2025
The 2023 and 2025 versions of Adobe ColdFusion can let a remote person insert their own commands and have the server execute them. This can happen without any user…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-105903 - coldfusion 2025
The 2025 and 2023 versions of Adobe ColdFusion can be tricked into running any code the attacker supplies, even from a low‑privilege account and without needing a user…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-75994 - coldfusion 2025
Adobe ColdFusion versions 2023 and 2025 contain a flaw that lets an attacker run any program on the server without needing a user to click anything. The issue is limited…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-106612 - coldfusion 2025
Adobe ColdFusion versions 2023 and 2025 can be tricked into running any code the attacker chooses, even without the user doing anything. This means a low‑level attacker…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-105899 - coldfusion 2025
Adobe ColdFusion versions 2025 and 2023 let attackers upload files of any type without checks. A malicious file could run code on the server, giving the attacker the…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-83662
Adobe Experience Manager can be tricked into showing a web page that runs code an attacker adds to a link. If a user clicks the crafted link, the added code could take control of their session or account. Avoid…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-63160
The Omnispace Agora Project stores its "remember me" login token in the same exact form as the user’s browser cookie. If someone obtains a copy of the database or a backup, they can use that token to log in as…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-63159 - agora project
The Agora Project version before 26.10.0 uses a password‑reset code that is calculated in a predictable way from the user’s login name and password. This lets someone…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-63158
Versions of Omnispace Agora Project before 26.10.0 treat a stored password hash like a login token. If someone obtains that hash, they can set a special cookie and sign in as any user, even an administrator,…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-63149
Versions of Omnispace Agora Project before 26.10.0 create temporary passwords using a method that is based on the server's clock. Because the password generation can be predicted when the account creation time…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stemshop.bsky.social🚨 CVE-2026-87855 — CVSS 9.8 CRITICAL The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versio... 🔎 https://stemshop.top/cve/CVE-2026-87855 #CVE #CyberSecurity #InfoSec
@stemshop.bsky.social🚨 CVE-2026-104800 — CVSS 9.8 CRITICAL The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includi... 🔎 https://stemshop.top/cve/CVE-2026-104800 #CVE #CyberSecurity #InfoSec
@euvd-bot.bsky.social🚨 EUVD-2026-100806 📊 8.0/10 🏢 NixOS 📝 Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before co... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100806 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100807 📊 4.3/10 🏢 NixOS 📝 Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100807 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-64002 📊 8.8/10 🏢 Linux 📝 In the Linux kernel, the following vulnerability has been resolved: vhost: reset the vring metadata cache on vring reconfiguration vq->meta_iotlb[] caches... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-64002 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100808 📊 4.0/10 🏢 NixOS 📝 The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root o... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100808 #cybersecurity #infosec #cve #euvd
@euvd-bot.bsky.social🚨 EUVD-2026-100809 📊 4.3/10 🏢 NixOS 📝 Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients. 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-100809 #cybersecurity #infosec #cve #euvd