133 matches found
CVE-2018-6389
CVE-2018-6389 WordPress DoS 攻击 CVE-2018-6389 参考 https://baraktawily.blogspot.jp/2018/02/how-to-dos-29-of-world-wide-websites.html 如何实施 DoS 攻击 启动 WordPress $ docker-compose up -d Pulling wordpress wordpress:4.9.3... 4.9.3: Pulling from library/wordpress e7bb522d92ff: Pull complete ... 3a3976cecfa7...
CLSA-2026-1790604947 TuxCare security update for webpack-dev-server (4 CVEs)
TuxCare rebuilt webpack-dev-server to address 4 CVEs. Fixed in 4.9.3-tuxcare.1...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: tcpdump (UTSA-2026-093168)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093168 advisory. The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory. Tenable has extracted the preceding description block directly from the...
CVE-2026-49825 affecting package python-lxml for versions less than 4.9.3-3
CVE-2026-49825 affecting package python-lxml for versions less than 4.9.3-3. A patched version of the package is available...
CVE-2026-9539 affecting package libslirp for versions less than 4.9.3-1
CVE-2026-9539 affecting package libslirp for versions less than 4.9.3-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-47277 Runtipi: Unauthenticated arbitrary file read through app-store logo symlinks
Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read through app-store logo symlinks. The path guard checks only...
CVE-2026-47277
Runtipi pre-4.10.0 is affected by an unauthenticated arbitrary file read through app-store logo symlinks. In versions 4.9.1–4.9.3, the public endpoint serves marketplace logos from files inside cloned app-store repositories; a logo symlink (e.g., metadata/logo.jpg) can cause the target file to be...
CVE-2026-47277 Runtipi: Unauthenticated arbitrary file read through app-store logo symlinks
Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read through app-store logo symlinks. The path guard checks only...
CVE-2026-7526 PDF Embedder <= 4.9.3 - Authenticated (Contributor+) Information Exposure via Block Editor Page
The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.9.3 via the enqueueblockassets. This makes it possible for authenticated attackers, with contributor-level access and above, to extract configuration data. License key...
CVE-2026-6381
The WP Maps WordPress plugin (versions prior to 4.9.3 ) is vulnerable to a Local File Inclusion (LFI) attack. The root cause is the improper sanitization of a parameter used in a file path, which allows authenticated users to perform LFI. This vulnerability is also described as a path traversal i...
CVE-2026-6381
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks...
CVE-2026-6381 WP Maps < 4.9.3 - Subscriber+ Local File Inclusion
The WP Maps WordPress plugin before 4.9.3 does not properly sanitize a parameter before using it in a file path, allowing authenticated users to perform Local File Inclusion attacks...
Advisory ROSA-SA-2026-3202
Software: tcpdump 4.9.3 OS: ROSA Virtualization 2.1 unaffected versions = tcpdump-4.9.3-5.rv3 affected versions tcpdump-4.9.3-5.rv3 CVE-ID: CVE-2021-41043 BDU-ID: 2025-16161 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the extractslice function of the network traffic analysis software tcpdump i...
Advisory ROSA-SA-2026-3184
Software: tcpdump 4.9.3 OS: ROSA Virtualization 3.0 unaffected versions = tcpdump-4.9.3-5.rv30 affected versions tcpdump-4.9.3-5.rv30 CVE-ID: CVE-2020-8037 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A vulnerability in the PPP decoder in tcpdump allows an attacker to cause a large memory allocation...
Advisory ROSA-SA-2026-3164
Software: tcpdump 4.9.3 OS: ROSA Virtualization 3.1 unaffected versions = tcpdump-4.9.3-5.rv31 affected versions tcpdump-4.9.3-5.rv31 CVE-ID: CVE-2020-8037 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A vulnerability in the PPP decoder in tcpdump allows an attacker to cause a large memory allocation...
MiracleLinux 8 : tcpdump-4.9.3-2.el8 (AXSA:2021-2659:02)
The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2021-2659:02 advisory. tcpdump: ppp decapsulator can be convinced to allocate a large amount of memory CVE-2020-8037 Tenable has extracted the preceding description block directly...
CVE-2025-14718
The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated...
CVE-2025-69361
CVE-2025-69361 is a Missing Authorization issue affecting PublishPress Post Expirator (post-expirator) up to version 4.9.3. Connected data confirms a Broken Access Control vulnerability with the same CVE, reported by Wordfence as patched (Patched) after initial disclosure. The Wordfence entry not...
CVE-2025-69361 WordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Expirator: from n/a through = 4.9.3...
PT-2025-43718
Name of the Vulnerable Software and Affected Versions Social Feed Gallery plugin for WordPress versions prior to 4.9.3 Description The Social Feed Gallery plugin for WordPress is susceptible to Information Exposure due to inadequate user authorization verification. This allows unauthenticated...