18337 matches found
CVE-2026-19683: Cleartext Transmission of Sensitive Information
A vulnerability exists in the Dynamic DNS DDNS functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and th...
ROS-20260820-73-0008
The vulnerability in freerdp3 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the PL/Per extension interface of the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the PL/Per extension interface of the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the pgdump utility in the PostgreSQL database management system is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the pg_stat_statements extension in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the pgstatstatements extension in the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Malicious code in npm-wold (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731c22e563f2ea15800d87f345de9b8363c0c715e9f39606201d47a8fb422ab1 [email protected] declares a postinstall script node dist/config.js that, on npm install, issues an HTTPS GET to the hardcoded endpoint...
MiracleLinux 8 : haproxy-1.8.27-5.el8_10.2 (AXSA:2026-1575:02)
The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1575:02 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 Tenable has extracted the preceding description block directly from the...
The vulnerability of the to_char(timestamptz) function in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the tochartimestamptz function in the PostgreSQL database management system is related to buffer overflow in dynamic memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
SUSE CVE-2026-68147
In the Linux kernel, the following vulnerability has been resolved: fscrypt: Avoid dynamic allocation in fscryptgetdevices When a blkcryptokey starts being used or is evicted, fs/crypto/ calls fscryptgetdevices to get the filesystem's list of block devices, then iterates over them and calls...
Duplicate Advisory: Grav: Blueprint dynamic-data bare-function branch is denylist-gated and omits error_log, giving arbitrary file write
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f8wv-xp27-6gq7. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function...
RLSA-2026:55679 Important: haproxy security update
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record...
CVE-2026-75827
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...
WordPress ECS plugin < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers vulnerability
Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers vulnerability discovered by Seongwon LEE in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...
WordPress ECS plugin < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings vulnerability
Contributor+ Stored XSS via Dynamic Repeater Bindings vulnerability discovered by Shivamani Vastrala in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...
RLSA-2026:55859 Important: haproxy security update
The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 For more details about the security issues, including the impact, a CVSS score...
RockyLinux 8 : haproxy (RLSA-2026:55859)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:55859 advisory. haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions CVE-2026-55204 Tenable has extracted the preceding description block directly from the...
RHEL 8 : haproxy (RHSA-2026:55861)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:55861 advisory. The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications. Security Fixes: haproxy: HAProx...
ROS-20260818-73-0038
The vulnerability in xrdp is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-75827: Improper Control of Generation of Code
Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...