6225 matches found
ROS-20260624-73-0025
The vulnerability in Netty is related to the failure to take measures to neutralize CRLF sequences. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20260624-73-0033
The vulnerability in Netty is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...
PT-2026-52084
Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.4 Description An authenticated user can watch a private repository without having the necessary access permissions. This occurs because the access check in the Watch API handler is inverted, specifically within the...
CVE-2026-47240 Net::IMAP: Command Injection via non-synchronizing literal in "raw" argument
Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing...
CVE-2026-47240
Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a "raw data" argument that is sent verbatim after validation to prevent command injection. However, if a server does not support non-synchronizing...
CVE-2026-47241
Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to 0.6.5 and 0.5.15, several Net::IMAP commands accept a raw string argument which is only validated to prevent CRLF injection and then sent verbatim. If this string is derived from user-controlled inpu...
EUVD-2026-36949
Unauthenticated Cross Site Scripting XSS in Social Slider Feed = 2.3.2 versions...
EUVD-2026-36926
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free = 5.3 versions...
EUVD-2026-36924
Shop manager PHP Object Injection in CTX Feed = 6.6.26 versions...
CVE-2026-39507
Unauthenticated Cross Site Scripting XSS in Social Slider Feed = 2.3.2 versions...
CVE-2026-39434
Shop manager PHP Object Injection in CTX Feed = 6.6.26 versions...
CVE-2026-39441
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free = 5.3 versions...
Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
Summary Before reading the first request-line, HttpObjectDecoder skips every byte for which Character.isISOControlb is true 0x00–0x1F and 0x7F as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance...
CVE-2026-39507 WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Social Slider Feed = 2.3.2 versions...
CVE-2026-39507 WordPress Social Slider Feed plugin <= 2.3.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Social Slider Feed = 2.3.2 versions...
CVE-2026-39507
The CVE-2026-39507 entry refers to the WordPress Social Slider Feed plugin, affected in versions <= 2.3.2, with an unauthenticated Cross Site Scripting (XSS) vulnerability. The issue is described as unauthenticated XSS in Social Slider Feed
CVE-2026-39441
CVE-2026-39441 affects the WordPress plugin Feed KuantoKusta for WooCommerce – Free, version
CVE-2026-39441 WordPress Feed KuantoKusta for WooCommerce – Free plugin <= 5.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free = 5.3 versions...