CVE-2026-42701 is a high-severity vulnerability in YayCommerce's YayMail plugin versions up to 4.4.6. It involves PHP Object Injection due to deserialization of untrusted data, allowing a shop manager with privileges to potentially execute harmful actions. The vulnerability has a CVSS score of 7.2, indicating significant impact on confidentiality, integrity, and availability.
CVE-2026-27394 is a high-severity vulnerability in Jyothis Joy Eventer versions up to 0.1.1 that allows unauthenticated attackers to perform Cross Site Scripting (XSS) due to improper neutralization of input during web page generation.
CVE-2026-118085 is a high-severity vulnerability in GlobalPayments WooCommerce versions up to 1.23.3. It is an unauthenticated Cross Site Scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows attackers to inject malicious scripts that can impact confidentiality, integrity, and availability.
Zimbra Collaboration versions prior to 10.1.21 are vulnerable to a stored cross-site scripting (XSS) flaw in the Classic UI. The vulnerability arises from improper sanitization of the From email header during HTML reply composition. An attacker can craft an email with a malicious From header containing JavaScript, which executes when the victim replies in HTML mode with reply headers disabled. This may allow session theft or unauthorized actions. The issue is fixed in version 10.1.21.
Zimbra Collaboration versions prior to 10.1.21 are vulnerable to a stored cross-site scripting (XSS) flaw via the Content-Location MIME header in email attachments. An unauthenticated attacker can send a crafted email containing a malicious Content-Location header set to a javascript: URI. When a victim opens the email in the Zimbra web interface and clicks the attachment name, the embedded JavaScript executes in the victim's browser context. This vulnerability was fixed in version 10.1.21.
CVE-2026-88078 is a vulnerability in Microsoft Edge (Chromium-based) involving improper verification of cryptographic signatures. This flaw could allow an unauthorized attacker to perform spoofing attacks over a network. The issue affects versions from 1.0.0.0 up to but not including 156.0.4314.42. Microsoft has released an official fix in version 156.0.4314.42. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-88077 is an integer overflow or wraparound vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to elevate privileges over a network. The vulnerability affects versions from 1.0.0.0 up to but not including 154.0.4258.62. A high-severity fix is available in version 154.0.4258.62.
CVE-2026-96196 is a high-severity vulnerability in Microsoft Edge (Chromium-based) caused by an incomplete list of disallowed inputs. This flaw allows an unauthorized attacker to bypass a security feature over a network. The issue affects versions from 1.0.0.0 up to but not including 156.0.4314.50. Microsoft has issued an official fix in version 156.0.4314.50.
CVE-2026-96187 is a high-severity vulnerability in Microsoft Edge (Chromium-based) involving access of a resource using an incompatible type, also known as type confusion. This flaw allows an unauthorized attacker to disclose information over a network. The vulnerability affects versions from 1.0.0.0 up to but not including 155.0.4283.45. An official fix is available in version 155.0.4283.45.
CVE-2026-85899 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) that allows an authorized attacker to elevate privileges over a network. The flaw affects versions from 1.0.0.0 up to but not including 155.0.4283.45. Microsoft has released an official fix in version 155.0.4283.45. The vulnerability has a high severity rating with a CVSS score of 8.1. No known exploits are currently reported in the wild.
CVE-2026-85330 is an incorrect authorization vulnerability in Microsoft Edge (Chromium-based) for Android. It allows an unauthorized attacker to bypass a security feature over a network. The issue affects versions from 1.0.0.0 up to but not including 155.0.4283.45. Microsoft has released an official fix in version 155.0.4283.45. The vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-88090 is a medium severity vulnerability in Microsoft Edge (Chromium-based) involving type confusion (CWE-843). It allows an unauthorized attacker to elevate privileges remotely by accessing resources using incompatible types. The flaw affects versions from 1.0.0.0 up to but not including 154.0.4258.37. Microsoft has issued an official fix in version 154.0.4258.37.
CVE-2026-114148 is a vulnerability in Microsoft .NET 10.0 installed on Linux where incorrect default permissions in ASP.NET Core allow an authorized local attacker to elevate privileges. The flaw affects multiple versions of .NET 8.0, 9.0, 10.0, and 11.0 preview releases prior to their respective fixed versions. The vulnerability has a high severity with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.
CVE-2026-20942 is a medium-severity vulnerability in Microsoft Edge (Chromium-based) involving improper restriction of rendered UI layers or frames. This flaw allows an unauthorized attacker to perform spoofing attacks over a network. The vulnerability affects versions from 1.0.0.0 up to but not including 156.0.4314.42. An official fix is available in version 156.0.4314.42.
CVE-2026-96203 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to elevate privileges over a network. The vulnerability affects versions from 1.0.0.0 up to but not including 155.0.4283.45. Microsoft has released an official fix in version 155.0.4283.45 to address this issue. The vulnerability has a high severity score of 8.8 and requires user interaction for exploitation.
CVE-2026-96192 is a use-after-free vulnerability in Microsoft Edge (Chromium-based) for iOS that allows an unauthorized attacker to execute code remotely over a network. The flaw affects versions from 1.0.0.0 up to but not including 155.0.4283.45. Microsoft has released an official fix in version 155.0.4283.45 to address this high-severity issue.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability where a remote authenticated attacker can obtain sensitive information due to improper sanitization of secrets during flow and project exports. This exposure of sensitive data does not affect integrity or availability but impacts confidentiality.