3893 matches found
ListingPro < 2.6.1 - Sensitive Data Disclosure
The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the /listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email...
Edito CMS - Sensitive Data Leak
Web services managed by Edito CMS Content Management System in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthorized user. id: CVE-2024-4836 info: name: Edito CMS - Sensitive Data Leak author: s4e-io severity: high description: | Web...
Jms Blog - SQL Injection
The module Jms Blog jmsblog from Joommasters contains a Time Based SQL injection vulnerability. This module is for the PrestaShop e-commerce platform and mainly provided with joommasters PrestaShop themes id: CVE-2023-27034 info: name: Jms Blog - SQL Injection author: MaStErChO severity: critical...
Important: Red Hat Security Advisory: webkit2gtk3 security update
An update for webkit2gtk3 is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common...
RHEL 8 : webkit2gtk3 (RHSA-2026:57348)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57348 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...
EUVD-2026-62363
An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...
CVE-2026-19709
The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one supplied in a request, allowing unauthenticated attackers to reach its REST routes and disclose any user's membership plan detail...
PT-2026-78321
An out-of-bounds read vulnerability was found in swtpm's SWTPM NVRAM CheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap...
CVE-2026-74934
Site isolation issue in the Graphics: CanvasWebGL component. This vuln...
CVE-2026-75485
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...
CVE-2026-32468
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...
CVE-2026-74962
CVE-2026-74962 is a site isolation issue in the Networking: Cookies component of Mozilla Firefox and Thunderbird . The flaw allows a cross-site isolation bypass, leading to high confidentiality and integrity impact (CVSS 8.1, HIGH). The attack requires user interaction over the network with no pr...
CVE-2026-64778
The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Visiting a maliciously crafted website may leak sensitive data...
CVE-2026-64778
The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Visiting a maliciously crafted website may leak sensitive data...
MINI-J95C-R4PP-VJMM
Bulletin has no description...
CVE-2026-74869
StoatChat before version 0.15.0 has a missing-authorization flaw in the Subscribe message handler: authenticated users can send a Subscribe message with any arbitrary server ID and receive live UserUpdate events (display names, avatars, status) for members of private servers they are not part of....
MINI-8FVP-8GC8-GQ83
Bulletin has no description...
PT-2026-76838
The issue was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Visiting a maliciously crafted website may leak sensitive data...
CVE-2024-58375
OpenTofu 1.8.0–1.8.2 do not properly restrict sensitive variables/locals when static evaluation is enabled, allowing potential leakage of values marked as sensitive through configuration elements. The issue is resolved in OpenTofu 1.8.3, which adds explicit errors to prevent use of sensitive valu...