CVE ID :CVE-2026-78529 Published : Oct. 10, 2026, 7:36 p.m. | 40 minutes ago Description :Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline,…
CVE ID :CVE-2026-105889 Published : Oct. 10, 2026, 5:17 p.m. | 59 minutes ago Description :Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a…
CVE ID :CVE-2026-104398 Published : Oct. 10, 2026, 5:16 p.m. | 59 minutes ago Description :Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from…
CVE ID :CVE-2026-108550 Published : Oct. 10, 2026, 3:16 p.m. | 2 hours, 59 minutes ago Description :SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge…
CVE ID :CVE-2026-108551 Published : Oct. 10, 2026, 3:16 p.m. | 2 hours, 59 minutes ago Description :openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted…
CVE ID :CVE-2026-108549 Published : Oct. 10, 2026, 3:16 p.m. | 2 hours, 59 minutes ago Description :cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform that accepts unauthenticated updates when no webhook_secret is…
CVE ID :CVE-2026-107845 Published : Oct. 9, 2026, 7:29 p.m. | 37 minutes ago Description :Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is…
Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. “Using the account of Takashi Kitao, author of the 18,400-star game engine pyxel,…
CVE ID :CVE-2026-107837 Published : Oct. 9, 2026, 6:17 p.m. | 1 hour, 50 minutes ago Description :RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. In 2026.07 and earlier, _receive() in sys can…
CVE ID :CVE-2026-107824 Published : Oct. 9, 2026, 6:17 p.m. | 1 hour, 50 minutes ago Description :x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger’s full functionality over HTTP. Prior to 1.1, x64dbg-MCP Server…