1049795 matches found
CVE-2026-120563: amirhelzer WPML Multilingual & Multicurrency for WooCommerce: The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all…
The WooCommerce Multilingual & Multicurrency with WPML plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 5.5.7. This is due to insufficient input validation on the currency exchange rate parameter in the savecurrency AJAX handler, which lacks capability...
CVE-2026-120559: satindersingh Contact Form Extender for Divi – Submissions DB & Extra Fields: The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to…
The Contact Form Extender for Divi Builder plugin for WordPress is vulnerable to Arbitrary File Deletion due to insufficient file path validation in the cfefdremoveuploadedfile function in all versions up to, and including, 1.0.6. This makes it possible for unauthenticated attackers to delete...
CVE-2026-120574: surecart: The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and…
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route VerificationCodeController::verify, whose permission callback returns true resolves an attacker-supplied login to any...
CVE-2026-121042: Google Chrome: Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker…
Incorrect authorization in Permissions in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-121225: Google Chrome: Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging…
Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...
CVE-2026-121201: Google Chrome: Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…
Use after free in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-121233: Google Chrome: Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary…
Type confusion in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-61495: hathach TinyUSB: TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class…
TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class helper mtpcontainergetstring in src/class/mtp/mtp.h that allows a malicious USB host to corrupt adjacent memory by supplying a crafted MTP string with an unbounded character coun...
CVE-2026-119485: weDevs Dokan: Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control…
Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2...
CVE-2026-119487: weDevs Dokan: Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control…
Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2...
CVE-2026-54161: networkupstools nut: Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS,…
Network UPS Tools is a collection of programs which provide a common interface for monitoring and administering UPS, PDU and SCD hardware. From 2.8.3 to 2.8.5, upsmon in clients/upsmon.c inserts the server-supplied ups.alarm value into shell commands executed by notify, asyncnotify, and wall. Whe...
CVE-2026-63476: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git reads a server-controlled targetSize while applying a packfile delta in src/utils/applyDelta.js and passes it without a bound to Buffer.alloctargetSize. A malicious or...
CVE-2026-63489: yeti-platform yeti: Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. In version 2.5.0 and earlier, YETI directly interpolates user-controlled sorting fields and filteraliases attribute paths into ArangoDB AQL identifier and expression positions in...
CVE-2026-63395: isomorphic-git: isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's git.checkout writes new child paths through symlinked leading directory components without checking them. A malicious repository can first place a directory symlink and later...
CVE-2026-63433: franklioxygen MyTube: MyTube is a self-hosted downloader and player for several video websites
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest, which grants a CSRF exemption based only on the presence of an x-api-key header or an Authorization: ApiKey val...
CVE-2026-121625: willamowius gnugk: GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that…
GNU Gatekeeper gnugk before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with...
CVE-2026-121565: Tanium: Tanium addressed an improper certificate validation vulnerability in multiple products
Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys...
CVE-2026-121580: Devolutions Server: Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an…
Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request...
CVE-2026-121614: Docker Docker Sandboxes: Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running…
Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write,...
CVE-2026-121626: willamowius gnugk: GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket()…
GNU Gatekeeper gnugk before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24...