The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.
The GutenKit WordPress plugin before 2.5.5 does not properly sanitize custom CSS saved against a post before printing it inside an inline style block on the published page, allowing users with the Author role and above to break out of the style element and store JavaScript that executes in the browser of any visitor who views the post. Exploitation affects sites running WordPress below 7.0.
The placester WordPress plugin through 1.4.3 does not perform any capability, nonce or ownership check on an AJAX action that updates account details, allowing unauthenticated attackers to overwrite any user's email address, including an administrator's, and take over the account through the standard password-reset flow.
The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.
The Mail Mage WordPress plugin through 0.0.25 does not properly sanitise and escape a user-supplied value before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.
The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.
A heap-based buffer overflow vulnerability exists in libilbm's ILBM file parsing functionality, allowing remote attackers to execute arbitrary code. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability is tracked as CVE-2025-10935 and has a high severity rating of 7.8 by the Zero Day Initiative.
A numeric truncation error vulnerability in Quest NetVault Backup allows remote attackers to cause a denial-of-service (DoS) condition without authentication. The vulnerability is identified as CVE-2026-13269 and has a high severity rating of 7.5 by the Zero Day Initiative.
A denial-of-service vulnerability exists in Quest NetVault Backup due to an integer underflow in the nvpmgr component. This flaw can be exploited remotely without authentication, causing affected systems to become unavailable. The vulnerability has been assigned CVE-2026-13270 and carries a high severity rating.
A local vulnerability in Philips Hue Bridge Pro allows attackers with low-privileged code execution within a container to modify files on the device. The vulnerability is rated with a low severity score of 3.8 by ZDI. Exploitation requires prior access to execute code in a restricted environment, limiting the attack surface.
A SQL injection vulnerability in Philips Hue Bridge Pro allows network-adjacent attackers to execute arbitrary code. Exploitation requires authentication, but the authentication mechanism can be bypassed. The vulnerability is assigned CVE-2026-118632 with a high severity rating.
A vulnerability in Philips Hue Bridge Pro allows network-adjacent attackers to bypass authentication without needing credentials. This flaw enables unauthorized access to the device's functions. The vulnerability has a high severity rating of 8.8 assigned by the Zero Day Initiative.
A use-after-free vulnerability in Trimble SketchUp's SKP file parsing allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability is assigned CVE-2026-121741 with a high severity rating by ZDI.
High7.1EPSS 0.1%Zero Day InitiativeCVE-2026-121614
A remote code execution vulnerability exists in Docker Sandboxes that allows local attackers to execute arbitrary code. Exploitation requires user interaction, such as visiting a malicious webpage or opening a malicious file. The vulnerability has been assigned CVE-2026-121614 and a CVSS rating of 7.8 by the Zero Day Initiative.
Medium5.4EPSS 0.1%Zero Day InitiativeCVE-2026-76181
A heap-based buffer overflow vulnerability in LibreOffice's dBase file parsing allows remote attackers to execute arbitrary code. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability has a high severity rating with a CVSS score of 7.8 assigned by the Zero Day Initiative.
A local privilege escalation vulnerability exists in Home Assistant Green due to cleartext storage of credentials. Exploitation requires an attacker to already have low-privileged code execution within a container on the affected system. The vulnerability has a high severity rating assigned by ZDI and is tracked as CVE-2026-91131.
A heap-based buffer overflow vulnerability exists in OriginLab Origin Viewer when parsing OGWU files. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page, and can lead to remote code execution. The vulnerability has a high severity rating assigned by ZDI.
A remote code execution vulnerability exists in OriginLab Origin Viewer due to an out-of-bounds write in OGG file parsing. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious webpage. The vulnerability has a high severity rating with a CVSS score assigned by ZDI of 7.8. No affected versions or patch information are provided.
A remote code execution vulnerability exists in OriginLab Origin Viewer due to an out-of-bounds write during OPJ file parsing. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page. The vulnerability is assigned CVE-2026-114560 with a high severity rating of 7.8 by ZDI.