95436 matches found
CVE-2026-18369
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...
CVE-2026-18369
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...
CVE-2026-18369 Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...
CLEANSTART-2026-RF99119 Security fixes in litellm-database 1.89.5-r0
Package litellm-database version 1.89.5-r0 fixes 4 vulnerabilities: CVE-2026-59936, CVE-2026-59935, CVE-2026-59937, CVE-2026-59938...
CLEANSTART-2026-JX06372 Security fixes in litellm-database 1.90.4-r0
Package litellm-database version 1.90.4-r0 fixes 1 vulnerabilities: CVE-2026-50271...
CLEANSTART-2026-IJ98637 Security fixes in litellm-database 1.90.2-r1
Package litellm-database version 1.90.2-r1 fixes 1 vulnerabilities: CVE-2026-0994...
CLEANSTART-2026-PS13289 Security fixes in litellm-database 1.91.3-r0
Package litellm-database version 1.91.3-r0 fixes 1 vulnerabilities: CVE-2026-50271...
CLEANSTART-2026-PU95946 Security fixes in litellm-database 1.91.1-r0
Package litellm-database version 1.91.1-r0 fixes 1 vulnerabilities: CVE-2026-50271...
CVE-2026-58046
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...
CVE-2026-13395
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
EUVD-2026-51013
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id
The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...
WordPress WP Hotel Booking plugin < 2.3.2 - Hotel Manager+ SQL Injection vulnerability
Hotel Manager+ SQL Injection vulnerability discovered by Mokksh Parekh in WordPress Plugin WP Hotel Booking versions 2.3.2...
CVE-2026-15153
The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks...
CVE-2026-67247
A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...
Laravel .env disclosure
Detects publicly accessible Laravel .env files that may leak database credentials, APPKEY, and other secrets. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel .env sensitive information disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHS...
CVE-2026-67247
CVE-2026-67247 describes a path traversal vulnerability in ADM’s IHM Log handling where user-controlled disk serial input is not sufficiently validated before being used to construct the path to an IHM log database file. An authenticated attacker could access an unintended filesystem path or log ...
CVE-2026-67247 A path traversal vulnerability was found in the IHM Log handling of ADM
A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...
CVE-2026-67247 A path traversal vulnerability was found in the IHM Log handling of ADM
A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occurs because user-controlled disk serial input is not sufficiently validated before being used to construct the path of an IHM log database file. An authenticated attacker can exploit this issue to cause...