New
CVE-2025-13391: Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion: The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'uni_cpo_remove_file'...
CVE-2026-24789: ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function: An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.
CVE-2026-25084: ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function: Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs.
CVE-2026-25869: MiniGal Nano <= 0.3.5 Path Traversal via dir Parameter: MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter. The application appends user-controlled input to the photos directory and attempts to prevent traversal by removing dot-dot sequences, but this protection can be bypassed using crafted directory patterns. An attacker can exploit...
CVE-2026-25868: MiniGal Nano <= 0.3.5 Reflected XSS via dir Parameter: MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application constructs $currentdir from user-controlled input and embeds it into an error message without output encoding, allowing an attacker to supply HTML/JavaScript that is reflected in the response....
Updated
CVE-2026-25084: ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function: Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs.
CVE-2026-24789: ZLAN Information Technology ZLAN5143D Missing Authentication for Critical Function: An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication.
CVE-2025-7195: Operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd: Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.1...
CVE-2026-25869: MiniGal Nano <= 0.3.5 Path Traversal via dir Parameter: MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter. The application appends user-controlled input to the photos directory and attempts to prevent traversal by removing dot-dot sequences, but this protection can be bypassed using crafted directory patterns. An attacker can exploit...
CVE-2026-1299: email BytesGenerator header injection due to unquoted newlines: The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized. This is only applicable if using "LiteralHeader" writing headers that don't respect email folding rules, the new behavior will rejec...
CISA Known Exploited Vulnerabilities
CVE-2026-21519 Microsoft Windows: Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.
CVE-2026-21513 Microsoft Windows: Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.
CVE-2026-21525 Microsoft Windows: Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.
CVE-2026-21514 Microsoft Office: Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.
CVE-2026-21533 Microsoft Windows: Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.