16141 matches found
WordPress Rank Math SEO plugin < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite vulnerability
Author+ Arbitrary Post and User Metadata Overwrite vulnerability discovered by Usama Arshad in WordPress Plugin Rank Math SEO versions 1.0.277...
CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...
CVE-2026-78584: Observable Response Discrepancy
Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...
Kibana 9.4.4 Security Update (ESA-2026-161)
Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges...
Kibana 8.19.18, 9.3.6, 9.4.3 Security Update (ESA-2026-158)
Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged...
EUVD-2026-66381
A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user...
CVE-2018-18572
creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:16+00:00| seen| https://t.me/hackingAttack/27119 2026-09-01 20:02:17+00:00| seen|...
Kibana 8.19.19, 9.3.5 Security Update (ESA-2026-48)
Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user can submit a specially crafted request that...
CVE-2026-84199
Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...
CVE-2026-84199
Kyverno before 1.16.2 is affected by a server-side request forgery (SSRF) vulnerability in its APICall feature. The URL field in a Policy's ServiceCall configuration is not validated , allowing a user with namespace-level Policy creation permissions to direct Kyverno to make HTTP requests to arbi...
CVE-2026-84199 Kyverno before 1.16.2 SSRF via APICall Feature
Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...
CVE-2026-84199 Kyverno before 1.16.2 SSRF via APICall Feature
Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...
CVE-2026-84199 Kyverno before 1.16.2 SSRF via APICall Feature
Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...
Exploit for Server-Side Request Forgery in Spip
CVE-2026-27472 and CVE-2026-27474 CVSS-B 5.3 MEDIUM and CVSS-...
CVE-2026-83596 Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature
A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling...
CVE-2026-82470
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...
EUVD-2026-68127
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...
CVE-2026-82470
Rodauth (a Ruby authentication library) before 2.47.0 contains a TOTP code reuse vulnerability in its otp feature. The root cause is a failure to track the last accepted code timestamp, allowing an attacker who observes a valid time-based one-time password to replay it within the drift window and...
PT-2026-83450
Rodauth before 2.47.0 contains a time-based one-time password reuse vulnerability in the otp feature that fails to track the last accepted code timestamp. Attackers who observe a valid TOTP code can replay it during the drift window to bypass the second authentication factor...