284312 matches found
CVE-2026-103101: Allocation of Resources Without Limits or Throttling
Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...
CVE-2026-18105: Uncontrolled Resource Consumption
An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...
CVE-2026-102386: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.003 versions...
CVE-2026-102384: Improper Neutralization of Input During Web Page Generation
Author Cross Site Scripting XSS in Supreme Modules Lite = 2.5.63 versions...
CVE-2026-102579: Exposure of Private Personal Information to an Unauthorized Actor
A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure...
CVE-2026-102454: Unrestricted Upload of File with Dangerous Type
EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...
CVE-2026-102578: Improper Neutralization of Special Elements used in an SQL Command
A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...
CVE-2026-103445: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS. This issue affects MediaWiki PageForms extension: 1.46, 1.45, and 1.43...
Open Interface Service Web Module Privilege Escalation
The vulnerability of the Open Interface Service in the web module of the Siemens Siveillance Control video surveillance and security management software is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to enhance their privileges and...
AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2026:1769515411)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1769515411 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the...
AlmaLinux 9.2 [TuxCare] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1739387851)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739387851 advisory. - URL Redirection to Untrusted Site 'Open Redirect' vulnerability in FORM authentication feature Apache Tomcat.This issue affects...
CVE-2026-97298: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in King Addons for Elementor = 51.1.86 versions...
PT-2026-103026
The Schema & Structured Data for WP & AMP WordPress plugin before 1.67 does not perform a capability check when saving several of its fields, nor escape them when outputting them back, allowing users with the editor role and above to inject arbitrary web scripts that execute when a higher...
Linux Distros Unpatched Vulnerability : CVE-2026-102310
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origi...
PT-2026-103625
Name of the Vulnerable Software and Affected Versions AJA HELO Plus versions prior to 2.1.7 Description A stored cross-site scripting issue exists that allows unauthenticated attackers with network access to inject malicious JavaScript. This occurs when the eParamID SystemName variable is set wit...
PT-2026-103276
Name of the Vulnerable Software and Affected Versions LiteSpeed Web Server LSWS versions prior to 6.3.7 build 1 Description LiteSpeed Web Server LSWS mishandles internal redirect URL validation in a specific corner case. This issue involves double decoding of the same data, which can lead to...
CVE-2026-93903: Double Decoding of the Same Data
LiteSpeed Web Server LSWS before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."...
PT-2026-103086
Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, leading to a SQL Structured Query Language injection. This...