Lucene search
+L

84119 matches found

SUSE Linux
SUSE Linux
added 2026/07/28 12:19 p.m.6 views

Security update for samba

This update for samba fixes the following issues CVE-2026-6949: TSIG packet with crafted name compression can crash internal DNS server bsc1271672. CVE-2026-15779: pamwinbind module with mkhomedir set allows chown of critical system paths without validation bsc1271469. CVE-2026-58216: 6-byte heap...

8.8CVSS5.9AI score0.011EPSS
SaveExploits0References28
EUVD
EUVD
added 2026/07/28 9:30 a.m.6 views

EUVD-2026-49734

The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with the use of wpunslash which removes...

7.5CVSS5.9AI score0.00304EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/28 9:27 a.m.33 views

CVE-2026-16462 SQL injection via unauthenticated GetGridData endpoint

In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands...

9.8CVSS0.00419EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/28 9:16 a.m.10 views

CVE-2026-13161

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldatatruebookeruser' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...

7.5CVSS0.00454EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/07/28 8:34 a.m.6 views

EUVD-2026-49721

The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppmprojfilter' parameter in versions up to, and including, 5.0.9. This is due to insufficient escaping on the user-supplied parameter and the lack of...

6.5CVSS6AI score0.00261EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/28 8:34 a.m.33 views

CVE-2026-12800 Premium Packages <= 6.2.0 - Unauthenticated SQL Injection

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupon REST API endpoint in versions up to, and including, 6.2.0. This is due to insufficient escaping on the user-supplied...

7.5CVSS0.00304EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/28 8:34 a.m.4 views

EUVD-2026-49720

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

7.5CVSS6AI score0.0029EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/28 7:47 a.m.22 views

CVE-2026-12741

CVE-2026-12741 affects the WordPress plugin WP Fast Total Search – The Power of Indexed Search, vulnerable via the form_data[s] parameter. All versions up to 1.80.280 fail to properly escape the user-provided input and do not sufficiently prepare the SQL query, enabling unauthenticated attackers ...

7.5CVSS6AI score0.00304EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/07/28 7:42 a.m.10 views

kernel: net: bridge: use a stable FDB dst snapshot in RCU readers

A flaw was found in the Linux kernel. Inconsistent handling of local Forwarding Database FDB entries in the bridge networking component's RCU Read-Copy-Update readers can lead to a null-pointer dereference. A local attacker could exploit this by triggering a concurrent update to an FDB entry,...

5.5CVSS5.8AI score0.00123EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/28 6:54 a.m.16 views

CVE-2026-15671

The CVE-2026-15671 entry concerns the WordPress plugin “SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery” (versions ≤ 3.9.7). It describes a generic SQL Injection via the id parameter caused by insufficient escaping and lack of proper query preparation in an ex...

4.9CVSS6AI score0.00288EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/07/28 12:31 a.m.6 views

EUVD-2021-34856

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. This key is not unique for each installation. An attacker that gains access to the MySQL server or a backup files can decrypt th...

5.9AI score0.0019EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/07/28 12:0 a.m.5 views

SUSE SLES15 Security Update : perl-DBI (SUSE-SU-2026:3283-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3283-1 advisory. This update for perl-DBI fixes the following issues - CVE-2026-14380: unvalidated string eval interpolation of the Profile package...

9.8CVSS6.2AI score0.00479EPSS
SaveExploits0References19
Tenable Nessus
Tenable Nessus
added 2026/07/28 12:0 a.m.5 views

SUSE SLES16 Security Update : perl-DBI (SUSE-SU-2026:22845-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22845-1 advisory. - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes...

9.8CVSS5.7AI score0.00387EPSS
SaveExploits0References13
Samba
Samba
added 2026/07/28 12:0 a.m.4 views

Samba AD authenticated LDAP access domain takeover

Description Samba AD stores internal database configuration in LDB special records such as @MODULES and @PARTITION. These records are not directory objects and should never be writable by a normal LDAP client. An authenticated low-privilege domain user can nevertheless modify them through LDAP. T...

5.9AI score
SaveExploits0
NVD
NVD
added 2026/07/27 10:16 p.m.9 views

CVE-2021-32087

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service...

8.8CVSS0.00293EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/27 7:22 p.m.7 views

EUVD-2026-49567

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value...

8.8CVSS6.3AI score0.00364EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/27 7:22 p.m.30 views

CVE-2026-56747

Cribl Stream before 4.18.2 is affected by an improper control of code generation in the JSON Pointer-to-accessor compiler. The vulnerability allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pa...

8.8CVSS6.3AI score0.00364EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/27 3:43 p.m.34 views

CVE-2026-66397 phpMyFAQ before 4.1.6 Path Traversal via category image deletion

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...

8.6CVSS0.00325EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/27 3:43 p.m.9 views

EUVD-2026-49330

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...

8.6CVSS5.9AI score0.00325EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/27 3:43 p.m.6 views

CVE-2026-66397 phpMyFAQ before 4.1.6 Path Traversal via category image deletion

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existingimage field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete. Attackers can delete the database.php configuration file to...

8.6CVSS5.9AI score
SaveExploits0References4
Rows per page
Query Builder