CVE-2026-56154

A use-after-free flaw was found in the modrewrite module of Apache HTTP Server when evaluating URL lookahead expressions that reference HTTP request headers, such as %LA-U:HTTP:.... A remote attacker may be able to trigger invalid memory access in a server using an affected rewrite configuration,...

EUVD-2026-95578

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...

CVE-2026-107935

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...

CVE-2026-107935

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the caller-supplied socket path, allowing an attacker to delete arbitrary files on the host system...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

CVE-2026-19585

A flaw was found in go-getter. A remote attacker can exploit a path traversal vulnerability to write files outside of the intended target directory during directory downloads from Amazon Simple Storage Service S3 or Google Cloud Storage GCS. By supplying specially crafted file paths within a remo...

CVE-2025-14123

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

EUVD-2025-211057

The Redux Framework plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 4.5.11. This is due to the plugin saving arbitrary meta keys under a registered option name without sufficient capability checks or key allowlist / restrictions. This makes it...

CVE-2026-93548

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user a request names, allowing any authenticated user to have the FooSales WordPress plugin before 1.43.3 act as an arbitrary other user, including an administrator, resulting in tha...

CVE-2025-15700

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly...

dlink

Iniezione di comandi e account backdoor nei dispositivi NAS D-Link Riepilogo della vulnerabilità: La vulnerabilità descritta interessa diversi dispositivi NAS D-Link, inclusi i modelli DNS-340L, DNS-320L, DNS-327L e DNS-325, tra gli altri. La vulnerabilità risiede nell'URI nassharing.cgi , che è...

Improper Input Validation

Hazelcast is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of data supplied by a malicious client connected to the cluster, which allows an attacker to read arbitrary memory from a cluster member, crash the member, or potentially corrupt memory and execu...

CVE-2026-107908

A heap-based out-of-bounds write in the BoltReadHandler function src/bolt/boltapi.c in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to cause a denial of service and possibly execute arbitrary code by sending a Bolt RESET message with an attacker-chosen chunk size to the Bolt...

WordPress AWP Classifieds plugin < 4.4.9 - Admin+ Arbitrary File Upload vulnerability

Admin+ Arbitrary File Upload vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin AWP Classifieds versions 4.4.9...

EUVD-2025-211055

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly...

CVE-2025-15700 AWP Classifieds < 4.4.9 - Admin+ Arbitrary File Upload via ZIP Import

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly...

CVE-2025-15700

The AWP Classifieds WordPress plugin, in versions before 4.4.9 , contains an arbitrary file upload vulnerability. The issue stems from a failure to validate the file types extracted from a ZIP archive during the listing-import feature. An attacker with management capabilities can exploit this to ...

WordPress Social Web Suite plugin <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update vulnerability

Unauthenticated Arbitrary Plugin Settings Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Social Web Suite versions = 4.1.12...

CVE-2026-88931 Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...