51383 matches found
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-005904)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005904 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and...
IBM InfoSphere 11.7.0.x <= 11.7.1.6 XXE Information Disclosure (7259630)
The version of IBM InfoSphere Information Server installed on the remote host is 11.7.0.0 through 11.7.1.6. It is, therefore, affected by an information disclosure vulnerability: - An XML External Entity XXE vulnerability in IBM InfoSphere Information Server could allow attackers to retrieve...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-005901)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005901 advisory. Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6...
PT-2026-23671
Missing Authorization vulnerability in Rank Math Rank Math SEO PRO allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO PRO: from n/a through 3.0.95...
Python Library OpenEXR 2.3.x / 3.x < 3.2.6 / 3.3.x < 3.3.8 / 3.4.x < 3.4.6 Heap Buffer Overflow
The version of the OpenEXR Python package installed on the remote host is 2.3.x or 3.x prior to 3.2.6, 3.3.x prior to 3.3.8, or 3.4.x prior to 3.4.6. It is, therefore, affected by a heap buffer overflow vulnerability: - In CompositeDeepScanLine::readPixels, per-pixel totals are accumulated in a...
Here’s Every Country Directly Impacted by the War on Iran
As the conflict in the Middle East continues to escalate, more than a dozen countries in the region have reportedly been affected by air strikes...
Plane is Vulnerable to Unauthenticated Workspace Member Information Disclosure
Executive Summary A security vulnerability exists in the Plane project management platform that allows unauthenticated attackers to enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django RE...
@amedia/brick-mcp (>=0.0.0-vSNAPSHOT-20260217144000, <=1.0.0), @area15/ticket-component (0.1.0) +108 more potentially affected by CVE-2026-3419 via fastify (>=5.7.2, <=5.7.4)
fastify NPM version =5.7.2, =0.0.0-vSNAPSHOT-20260217144000, =0.5.2, =0.5.2, =0.5.2, =0.5.2, =0.2.11, =2.4.2-next.143, =2.4.2-next.143, =2.4.2-next.143, =2.4.2-next.143, =2.11.6, =5.1.19, =2.21.2, =2.21.2, =2.21.3 and more Source cves: CVE-2026-3419 Source advisory: OSV:GHSA-573F-X89G-HQP9...
CVE-2026-2593
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gspbpostcss post meta value and the dynamicAttributes block attribute in all versions up to, and including, 12.8.5 due to insufficient input sanitization and output escapin...
CVE-2026-29077
Frappe is a full-stack web application framework. Prior to versions 15.98.0 and 14.100.0, due to a lack of validation when sharing documents, a user could share a document with a permission that they themselves didn't have. This issue has been patched in versions 15.98.0 and 14.100.0...
EC-CUBE has a Vulnerability that Allows MFA Bypass in the Administrative Interface
Vulnerability Allowing MFA Bypass Affected EC-CUBE Versions Versions: 4.1.0 – 4.3.1 Vulnerability Overview If an administrator’s ID and password are compromised, an issue exists that allows an attacker to bypass the normally required two-factor authentication 2FA and log in to the administrative...
CVE-2026-28782
Craft is a content management system CMS. Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission where the "Duplicate" action is...
CVE-2026-28209 FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech TTS engine in the recordings module. This issue has been patched in versions 16.0.20...
CVE-2026-29054
CVE-2026-29054 (Traefik) affects Traefik HTTP reverse proxy/load balancer from versions 2.11.9–2.11.37 and 3.1.3–3.6.8. The issue arises when Traefik processes HTTP/1.1 requests: the protection that prevents removal of Traefik-managed X-Forwarded headers via the Connection header compares tokens ...
CVE-2026-30794
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Malicious AI Assistant Extensions Harvest LLM Chat Histories
Microsoft Defender has been investigating reports of malicious Chromium‑based browser extensions that impersonate legitimate AI assistant tools to harvest LLM chat histories and browsing data. Reporting indicates these extensions have reached approximately 900,000 installs. Microsoft Defender...
CVE-2026-30790
...
CVE-2026-30790 RustDesk Server Controls All Handshake Entropy (Salt/Challenge), Enabling Offline Brute-Force
Improper Restriction of Excessive Authentication Attempts, Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux Peer authentication, API login modules, rustdesk-server RustDesk Server OSS...
EUVD-2026-9819
The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the 'installandactiveplugin' function in all versions up to, and including, 1.4.24. This...