375 matches found
Astra Linux – Vulnerability in Ruby 2.5
A issue was discovered in Ruby 3.x through 3.3.0. If data supplied by an attacker is provided to the Ruby regex compiler, it is possible to extract arbitrary heap data relative to the start of the text, including pointers and sensitive strings. The fixed versions are 3.0.7, 3.1.5, 3.2.4, and 3.3....
PT-2026-105732
These are all security issues fixed in the python313-openpyxl-3.1.5-1.8 package on the GA media of openSUSE Tumbleweed...
Astra Linux – Vulnerability in Jinja2
Jinja is an extensible templating engine. Prior to version 3.1.5, there was a flaw in how the Jinja sandbox environment detected calls to str.format, allowing an attacker who controls the content of a template to execute arbitrary Python code. To exploit this vulnerability, an attacker needed to...
CVE-2026-81288: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...
WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ivaylo Atanassov in WordPress Plugin Upsell Order Bump Offer for WooCommerce versions = 3.1.5...
CLSA-2026-1776818202 TuxCare security update for engine.io (2 CVEs)
TuxCare rebuilt engine.io to address 2 CVEs. Fixed in 3.1.5-tuxcare.1...
CLSA-2026-1774657359 TuxCare security update for minimatch (3 CVEs)
TuxCare rebuilt minimatch to address 3 CVEs. Fixed in 3.1.5-tuxcare.1...
Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
Impact Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute Patches Upgrade to v3.1.5 or later. This version includes this patch https://github.com/pion/stun/pull/278 which fixes the issue. Workarounds No work around; please upgrade to v3.1.5 or a newer versio...
GHSA-34RH-WP3J-6CXC Pion STUN vulnerable to remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute
Impact Remote denial of service via panic while parsing a malformed XOR-MAPPED-ADDRESS attribute Patches Upgrade to v3.1.5 or later. This version includes this patch https://github.com/pion/stun/pull/278 which fixes the issue. Workarounds No work around; please upgrade to v3.1.5 or a newer versio...
WordPress JS Help Desk plugin < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure vulnerability
Subscriber+ Cross-User Support Ticket Disclosure vulnerability discovered by Sai Praneeth Koti in WordPress Plugin JS Help Desk versions 3.1.5...
CVE-2026-15209 JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR
The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...
Siemens SIMATIC S7-1500 CPU 1518 MFP Type Confusion (CVE-2026-43038)
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505843; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate",...
Siemens SIMATIC S7-1500 CPU 1518 MFP Deadlock (CVE-2026-23446)
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505635; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...
Siemens SIMATIC S7-1500 CPU 1518 MFP Operation on a Resource after Expiration or Release (CVE-2026-23271)
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505716; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate",...
Siemens SIMATIC S7-1500 CPU 1518 MFP Improper Input Validation (CVE-2026-23100)
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505857; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...
CVE-2026-63744
SurrealDB before 3.1.5 contains a server-side request forgery vulnerability in the JWKS fetcher that follows HTTP redirects without re-validating redirect targets against network capabilities. Attackers with Owner role can configure a JWKS URL pointing to an allowlisted host that redirects to...
CVE-2026-63737
SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack...
CVE-2026-63737 SurrealDB before 3.1.5 Denial of Service via deep operator chains
SurrealDB versions before 3.1.5 contain a denial of service vulnerability where authenticated users can crash the server with queries containing long chains of operators. Attackers can submit queries with tens of thousands of chained operators that create unbounded expression trees, causing stack...
CVE-2026-63309
SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records...
PT-2026-60807
SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records...