594 matches found
CVE-2022-2274
CVE-2022-2274 Un POC de CVE-2022-2274 openssl El lanzamiento de OpenSSL 3.0.4 introdujo un error grave en la implementación de RSA para CPUs X8664 que admiten las instrucciones AVX512IFMA. Este problema hace que la implementación de RSA con claves privadas de 2048 bits sea incorrecta en dichas...
Astra Linux – Vulnerability in ruby-sinatra
Sinatra is a domain-specific language for creating web applications in Ruby. A vulnerability was discovered in Sinatra 2.0 before versions 2.2.3 and 3.0 before version 3.0.4. The application is vulnerable to a reflected file download RFD attack, which causes the Content-Disposition header of a...
gimp security update
2:3.0.4-4.10 - fix CVE-2026-59090 - fix CVE-2026-18301 - fix CVE-2026-18302 - fix CVE-2026-18303 - fix CVE-2026-18304 - fix CVE-2026-18305 - fix CVE-2026-18306 - fix CVE-2026-18307 - fix CVE-2026-18308...
CLSA-2026-1774484507 TuxCare security update for minimatch (1 CVE)
TuxCare rebuilt minimatch to address 1 CVE. Fixed in 3.0.4-tuxcare.1...
CLSA-2026-1774657358 TuxCare security update for minimatch (1 CVE)
TuxCare rebuilt minimatch to address 1 CVE. Fixed in 3.0.4-tuxcare.3...
CLSA-2026-1773447390 TuxCare security update for jspdf (1 CVE)
TuxCare rebuilt jspdf to address 1 CVE. Fixed in 3.0.4-tuxcare.2...
CLSA-2026-1773447392 TuxCare security update for jspdf (4 CVEs)
TuxCare rebuilt jspdf to address 4 CVEs. Fixed in 3.0.4-tuxcare.4...
CLEANSTART-2026-RY66554 Security fixes in grafana-mimir-fips 3.0.4-r1
Package grafana-mimir-fips version 3.0.4-r1 fixes 1 vulnerabilities: CVE-2026-34986...
CLEANSTART-2026-ZY02248 Security fixes in cosign 3.0.4-r0
Package cosign version 3.0.4-r0 fixes 1 vulnerabilities: ghsa-59jp-pj84-45mr...
PT-2026-63541
Name of the Vulnerable Software and Affected Versions PhotoSwipe - Responsive JavaScript Modal Image Gallery versions 0.0.0 through 3.2.0 Description A missing authorization issue allows forceful browsing when viewing images using the photoswipe image gallery display formatter. The module fails t...
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue...
Apache Superset: Improper error handling on alerts
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert...
PYSEC-2026-1185 Apache Superset: Improper Neutralization of custom SQL on embedded context
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, whi...
PYSEC-2026-730 Plone Cross-site Scripting vulnerability in the LiveSearch module
Cross-site scripting XSS vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag...
CVE-2026-57348 WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability
Unauthenticated Server Side Request Forgery SSRF in Paid Member Subscriptions = 3.0.4 versions...
WordPress Paid Member Subscriptions plugin <= 3.0.4 - Server Side Request Forgery (SSRF) vulnerability
Server Side Request Forgery SSRF vulnerability discovered by yangsori in WordPress Plugin Paid Member Subscriptions versions = 3.0.4...
CVE-2026-56032
The CVE-2026-56032 entry concerns a PHP Object Injection vulnerability in the WordPress BuddyBoss Platform plugin, affecting versions up to 3.0.4. The root cause is described as Subscriber PHP Object Injection within BuddyBoss Platform <= 3.0.4. Documented in Patchstack and CVE records, the vu...
EUVD-2026-39695
Subscriber PHP Object Injection in Buddyboss Platform = 3.0.4 versions...
CVE-2026-56032 WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in Buddyboss Platform = 3.0.4 versions...
NPM: http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in `fixRequestBody`
NPM: http-proxy-middleware: multipart/form-data field injection via unescaped CRLF in fixRequestBody vulnerability discovered by ? in WordPress Npm http-proxy-middleware versions = 3.0.4, 3.0.7...