13005 matches found
CVE-2026-61511
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5TemplateRuntime::runMaths method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenavpagenumber...
Information Exposure
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the GraphQL error message handling process. An attacker can obtain the names of required custom inp...
PT-2026-64437
These are all security issues fixed in the libsrt1 5-1.5.6-1.1 package on the GA media of openSUSE Tumbleweed...
Plone @plone/volto 14.0.0-alpha.5 < 15.0.0-alpha.0 Insecure Authentication
The version of the @plone/volto Node.js Package installed on the remote host is later than 14.0.0-alpha.5 prior to 15.0.0-alpha.0. It is, therefore, affected by an insecure authenticaiton vulnerability. A user could have their authentication cookie replaced with an authentication cookie from...
PT-2026-62011
Malcolm v26.07.0 adds IEC 60870-5-104 IEC 104 protocol support using CERT.LV's Zeek plugin, including Logstash parsing, ECS normalization, Arkime fields, and a new OpenSearch Dashboards dashboard. This release also fixes three archive extraction and authentication security vulnerabilities; improv...
Security update for afterburn
This update for afterburn fixes the following issues: Update to version 5.10.0.git73.b97f772. Security issues fixed: CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 bsc1270175. CVE-2026-41677: openssl: out-of-bounds read in PEM password...
CVE-2026-37555 affecting package libsndfile for versions less than 1.2.2-5
CVE-2026-37555 affecting package libsndfile for versions less than 1.2.2-5. A patched version of the package is available...
PT-2026-57299
RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange...
Siemens SIPROTEC 5 Using DIGSI5 Protocol Unrestricted Upload of File with Dangerous Type (CVE-2025-40808)
The affected application allows authenticated users to upload arbitrary files using DIGSI 5 protocol. This could allow an attacker to upload malicious configuration files, that could cause denial of service condition and potentially lead to code execution. This plugin only works with Tenable.ot...
CVE-2026-42502 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5
CVE-2026-42502 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...
CVE-2026-25680 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5
CVE-2026-25680 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...
CVE-2026-25681 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5
CVE-2026-25681 affecting package cloud-provider-kubevirt for versions less than 0.5.1-5. A patched version of the package is available...
CVE-2026-13199
EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produced non-random KASLR and RNG seed values. This resulted in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the...
EUVD-2026-42015
Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifiers. This issue affects Ontime: through 04052026...
CVE-2026-13245
The MaxButtons – Create buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'view' parameter in all versions up to, and including, 9.8.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
GHSA-45GG-VH54-H5M9 vulnerabilities
Vulnerabilities for packages: chisel-fips, knative-eventing-fips, nerdctl, k9s-fips, spire-server, cilium-cli, harbor-fips, tigera-operator, argo-cd-fips, gatekeeper-fips, prometheus-operator, kubernetes, backup-restore-operator, k9s, keda-fips, gitea-fips, flux-image-automation-controller-fips,...
CVE-2026-8643 affecting package python-virtualenv for versions less than 20.36.1-5
CVE-2026-8643 affecting package python-virtualenv for versions less than 20.36.1-5. A patched version of the package is available...
CVE-2026-9698 affecting package perl-DBI for versions less than 1.643-5
CVE-2026-9698 affecting package perl-DBI for versions less than 1.643-5. A patched version of the package is available...
[SECURITY] [DSA 6357-1] pillow security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6357-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 21, 2026 https://www.debian.org/security/faq -...