6557319 matches found
CVE-2026-77928 ClipBucket 5.5.3 Blind SQL Injection via Private Message Deletion Endpoint
ClipBucket v5 through 5.5.3 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msgid parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass unsanitized...
CVE-2026-93676 Xdg-dbus-proxy: xdg-dbus-proxy: filtering for broadcast messages bypasses path/interface/member checks
xdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive...
CVE-2026-93566 Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
Summary Netty skips strict chunk size line validation when the line has no chunk extension ;, so a chunk size line containing an embedded bare CR e.g. 0\rX is accepted instead of rejected, enabling HTTP request smuggling. Details io.netty.handler.codec.http.HttpObjectDecodercheckChunkExtensions...
CVE-2026-93565 Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte
Summary RtspMethods.valueOf silently strips trailing control bytes any character with code point = 0x20, the full range that String.trim removes before performing a cache lookup against its ten pre-populated method constants. A wire-delivered RTSP request whose method token ends with a trailing...
CVE-2026-77927 ClipBucket 5.5.3 Blind SQL Injection via Photo Deletion Endpoint
ClipBucket v5 through 5.5.3 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the checkphoto parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass...
CVE-2026-93505 SveltyCMS SVG Media Upload media-service.server.ts cross site scripting
A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named...
CVE-2026-93653 Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)
A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline...
CVE-2026-93564 Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)
HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak incomplete fix of PR 16881...
CVE-2026-93558 Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service
Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service...
CVE-2026-93019 Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tgapaletteread. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tgapaletteread casts that value to sizet and asks...
CVE-2026-93019 Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read
Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tgapaletteread. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tgapaletteread casts that value to sizet and asks...
CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p
Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...
CVE-2026-93018 Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in i_gpix_p and i_glin_p
Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in igpixp and iglinp. The palette is allocated uninitialised, and only the entries a reader adds count as populated. The TGA reader stores pixel indexes without...
WordPress Dictionary plugin <= 1.0 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Dictionary versions = 1.0...
WordPress WPLP Cookie Consent plugin < 4.4.4 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.4...
WordPress Dewa Kirim plugin <= 1.0.0 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Dewa Kirim versions = 1.0.0...
WordPress Dictionary plugin <= 1.0 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Dictionary versions = 1.0...
WordPress WP Travel Engine plugin < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image vulnerability
Subscriber+ Arbitrary Media File Move via userprofileimage vulnerability discovered by marim00 in WordPress Plugin WP Travel Engine versions 6.8.1...
CVE-2026-62282 OpenCVE: Server-Side Request Forgery (SSRF) in notifications
OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests ...
CVE-2026-62282 OpenCVE: Server-Side Request Forgery (SSRF) in notifications
OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not sufficiently validate user-supplied HTTP or HTTPS destinations. An authenticated user with permission to configure notification channels can trigger requests ...