WordPress plugin DSGVO Google Web Fonts GDPR 代码问题漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-31095

Name of the Vulnerable Software and Affected Versions DSGVO Google Web Fonts GDPR plugin for WordPress versions up to and including 1.1 Description The DSGVO Google Web Fonts GDPR plugin for WordPress is susceptible to arbitrary file upload due to the absence of file type validation in the...

The vulnerability of the setGameSpeedCfg function in the microprogramming software of TOTOLink A7100RU allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the setGameSpeedCfg function in the microprogramming software of TOTOLink A7100RU relates to the lack of measures taken to protect data at the control level. Exploiting this vulnerability can allow an attacker operating remotely to compromise the confidentiality, integrity, a...

PT-2026-30972

OrangeHRM is a comprehensive human resource management HRM system. From 5.0 to 5.8, OrangeHRM Open Source encrypts certain sensitive fields with AES in ECB mode, which preserves block-aligned plaintext patterns in ciphertext and enables pattern disclosure against stored data. This vulnerability i...

The vulnerability of the cpp-httplib library, related to insufficient protection of service data, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the cpp-httplib library is related to insufficient protection of service data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the protected information...

The vulnerability of the WebKit component in the Safari browser for operating systems macOS, iOS, iPadOS, and visionOS allows attackers to circumvent security restrictions.

The vulnerability of the WebKit component in the Safari browser for operating systems macOS, iOS, iPadOS, and visionOS is related to a violation of data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass security restrictions remotely...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, arises from improper encoding or escaping of output data. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, is related to improper coding or escape sequences used to protect output data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

The vulnerability of microprogrammed software in embedded access controllers of Dell iDRAC9 lies in the insufficient protection of service data when transitioning to debugging mode, allowing a intruder to gain unauthorized access to protected information.

The vulnerability of microprogramming software in embedded access controllers of Dell iDRAC9 relates to insufficient protection of service data when entering debugging mode. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the ttwu_queue_cond() function in the kernel/sched/core.c module, which is part of the Linux operating system’s resource management support mechanism, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ttwuqueuecond function in the kernel/sched/core.c module, which is part of the Linux operating system’s resource management support mechanism, involves an unvalidated error condition. Exploiting this vulnerability could allow a remote attacker to compromise the...

The vulnerability of the Delegated License Service (DLS) component of NVIDIA’s licensing system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Delegated License Service DLS component of NVIDIA’s licensing system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

Mbed TLS -- vulnerabilities

https://mbed-tls.readthedocs.io/en/latest/security-advisories/ reports: Client impersonation while resuming a TLS 1.3 session CVE-2026-34873 Entropy on Linux can fall back to /dev/urandom CVE-2026-34871 PSA random generator cloning CVE-2026-25835 Compiler-induced constant-time violations...

The vulnerability of the exclude_super_stripes() function in the fs/btrfs/block-group.c file of the btrfs file system in the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the excludesuperstripes function in the fs/btrfs/block-group.c file of the btrfs file system in the Linux kernel is related to the execution of operations outside of the buffer in memory. Exploitation of this vulnerability could allow a remote attacker to compromise the...

WordPress DSGVO snippet for Leaflet Map and its Extensions plugin <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'unset' Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'unset' Attribute vulnerability discovered by zaim in WordPress Plugin DSGVO snippet for Leaflet Map and its Extensions versions = 3.1...

The vulnerability of the xf_AppUpdateWindowFromSurface() function in the RDP client FreeRDP allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the xfAppUpdateWindowFromSurface function in the RDP client FreeRDP relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2026-4283

The WP DSGVO Tools GDPR plugin for WordPress is vulnerable to unauthorized account destruction in all versions up to, and including, 3.1.38. This is due to the super-unsubscribe AJAX action accepting a processnow parameter from unauthenticated users, which bypasses the intended email-confirmation...

The vulnerability of the rtw_wx_set_scan() function in the drivers/staging/r8188eu/os_dep/ioctl_linux.c module allows a hacker to cause a service failure. This vulnerability exposes additional devices supported by the Linux operating system’s kernel.

The vulnerability of the rtwwxsetscan function in the drivers/staging/r8188eu/osdep/ioctllinux.c module, which supports additional devices in the Linux operating system, is related to insufficient protection for service data. Exploiting this vulnerability could allow an attacker to cause a servic...

DEBIAN-CVE-2026-33222

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them...

CVE-2026-33222

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them...

CVE-2026-33222

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, users with JetStream admin API access to restore one stream could restore to other stream names, impacting data which should have been protected against them...