24432 matches found
WordPress Event Tickets Manager for WooCommerce plugin <= 1.5.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by okndjo in WordPress Plugin Event Tickets Manager for WooCommerce versions = 1.5.5...
CVE-2026-57249
CVE-2026-57249 affects Foxit PDF Editor/Reader in the annotation handling path. After opening a PDF, the software resets the annotation status and triggers a reset form event; during the subsequent re-entry it accesses invalid objects, leading to a crash. CVSS 3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/...
CVE-2026-59995
creationtimestamp| type| source ---|---|--- 2026-07-08 03:56:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq47zpcevu24 2026-07-08 22:47:27+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3mq677cepsk2y 2026-07-10 04:02:17+00:00| seen|...
PT-2026-56451
MISP’s importModule path used getEnabledModule to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules. As a result, an authenticated user from an organisation that was not allowed to use a module restricted v...
ECA: Event - Condition - Action - Less critical - Information disclosure - SA-CONTRIB-2026-074
The Events, Conditions, Actions ECA module's Render submodule enables you to build render arrays and render inline Twig templates as part of no-code ECA models. The module doesn't sufficiently sanitize template code when rendering, which can lead to information disclosure. This vulnerability is...
PT-2026-56603
Name of the Vulnerable Software and Affected Versions libp2p versions prior to 16.0.0 Description In the @libp2p/gossipsub module, the defaultDecodeRpcLimits configuration sets maxIhaveMessageIDs and maxIwantMessageIDs to Infinity. This allows oversized IHAVE and IWANT control message arrays in...
PT-2026-56404
Name of the Vulnerable Software and Affected Versions Essential Addons for Elementor versions prior to 6.6.3 Description Stored Cross-Site Scripting XSS occurs in the Event Calendar widget due to insufficient input sanitization and output escaping on event titles sourced from The Events Calendar...
CVE-2020-28736
creationtimestamp| type| source ---|---|--- 2026-07-07 21:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq3kso52ml2f...
CVE-2020-28735
creationtimestamp| type| source ---|---|--- 2026-07-07 21:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq3j4zaqre2f...
CVE-2026-53479
creationtimestamp| type| source ---|---|--- 2026-07-07 16:08:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2yhdqmmp27 2026-07-08 09:00:23+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mq4qyhbjfr2v...
PYSEC-2026-1712 OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
Impact OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command defined in a system event handler an...
PYSEC-2026-1226 Bugsink path traversal via event_id in ingestion
Summary In affected versions, ingestion paths construct file locations directly from untrusted eventid input without validation. A specially crafted eventid can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such...
PYSEC-2026-1897 Salt vulnerable to arbitrary event injection
Arbitrary event injection on Salt Master. The master's "minionevent" method can be used by and authorized minion to send arbitrary events onto the master's event bus...
PYSEC-2026-1899 Salt has minion event bus authorization bypass vulnerability
Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions = 3007.0...
GO-2026-5854 Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance in github.com/fission/fission
Fission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance in github.com/fission/fission...
PYSEC-2026-1975 Tornado has an HTTP cookie parsing DoS vulnerability
The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests. See...
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()
A flaw was found in the Linux kernel's RDMA/mlx4 component. This vulnerability arises from the incorrect use of Read-Copy Update RCU in the mlx4srqevent function. An attacker could potentially trigger an event before the srq object is fully initialized, leading to a system crash. This could resul...
CVE-2026-53483
creationtimestamp| type| source ---|---|--- 2026-07-07 13:12:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq2olmx4az2r 2026-07-07 15:42:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq2wy66mom2o 2026-07-09 03:07:07+00:00| seen|...