266158 matches found
CVE-2026-102568 Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py
Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including D...
EUVD-2026-88969
Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including D...
CVE-2026-102568 Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py
Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local users to disable parental controls as root. Attackers can invoke PPCActivator.py with the --disable argument via pkexec to remove all restrictions including D...
CVE-2026-102568
Pardus Parental Control versions before 0.7.0 are vulnerable to an incorrect authorization flaw within the polkit policy . This allows unprivileged local users to bypass security measures by invoking PPCActivator.py with the --disable argument via pkexec . Successful exploitation enables an attac...
CVE-2025-33207
NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service...
CVE-2025-33207
NVIDIA Networking BlueField and ConnectX products are vulnerable to a flaw in a control register (CWE-1262). A user with VF access can send a malicious command to the firmware, resulting in improper access control for the register interface. Successful exploitation may lead to a denial of service...
CVE-2025-33207
NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service...
EUVD-2025-211016
NVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF access could cause improper access control for the register interface by sending a malicious command to the firmware. A successful exploit of this vulnerability might lead to denial of service...
Improper Neutralization of Special Elements in Data Query Logic
Overview apache-airflow-providers-google is a Provider for Apache Airflow. Implements apache-airflow-providers-google package Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via GoogleDriveHook in drive.py, where folder names, fi...
WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by onecomputerguy in WordPress Plugin Hostinger Migrator versions = 1.0...
WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin AllAble Connector versions = 0.13.4...
PYSEC-2026-4188
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
WSO2 CVE-2026-5430 JWT Auth Bypass Detect
Detects CVE-2026-5430 in WSO2 API Manager / Control Plane / Traffic Manager / Universal Gateway: JWTUtil accepts tokens whose alg header is outside the supported RS256/384/512 set. Probes admin APIs with an alg:none X-JWT-Assertion. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WSO2...
CVE-2026-81930 Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
CVE-2026-81930
The Apache Airflow Snowflake provider fails to validate the account and region fields before interpolating them into request URLs. An attacker can provide values containing /, ?, or # to demote the intended domain to a path, query, or fragment, allowing them to control the request host. This enab...
EUVD-2026-88696
Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. The SQL API endpoint is built as https://account.snowflakecomputing.com/api/v2/statements, so an account value containing /, ? or demotes the intended domai...
WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MCP Content Manager Lite versions = 1.1.0...
WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Zahid Abbasi in WordPress Plugin FormGent versions = 1.12.2...
Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to undici and nodemailer.
Summary IBM App Connect Enterprise Runtime is vulnerable to multiple vulnerabilities due to undici and nodemailer. Vulnerability Details CVEID:CVE-2026-13697 DESCRIPTION: undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0....
WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Morato Antoine in WordPress Plugin WP Express Checkout Accept PayPal Payments versions = 2.4.9...