1103 matches found
CVE-2026-54215
CVE-2026-54215 affects Tobit Laboratories AG TeamDavid’s Webbox (through Rollout 524). The vulnerability is an open redirect triggered by the replyUrl parameter, enabling an attacker to craft a URL that redirects users’ browsers to an arbitrary third-party site. This can be abused for phishing by...
CVE-2026-61964
Unauthenticated Cross Site Scripting XSS in Ninja Tables = 5.2.9 versions...
CVE-2026-16734
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a...
CVE-2026-11454
The Groundhogg WordPress plugin (versions <= 4.5.2) is affected by an Insecure Direct Object Reference via GET /wp-json/gh/v4/contacts/. The endpoint’s permission callback only checks a role-level view_contacts capability, and read_single() returns full contact records without object-level own...
CVE-2026-16736 User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration...
CVE-2026-16736
CVE-2026-16736 affects the WordPress plugin User Registration & Membership (versions prior to 5.2.6). The issue: registration submissions do not respect the site’s registration-disabled setting, enabling unauthenticated users to create accounts even when open registration is turned off. Impact is...
CVE-2026-15337
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...
CVE-2026-15920
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...
CVE-2026-15830
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango's django.contrib.gis.geos.GEOSGeometry is subject to a potential denial-of-service when parsing deeply nested GEOMETRYCOLLECTION objects supplied as well-known text WKT, well-known binary WKB, or hex-encoded WKB,...
EUVD-2026-52748
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...
Malicious code in internallib_v524 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eba59f6d895fdeae2b83c62331fbb87118aa51202fd30ddc351fa43276408a44 The package's main module exports a function command that invokes /bin/bash -c to fetch a script from reverse-shell.sh and pipe it into sh, connectin...
CLEANSTART-2026-VF32547 Security fixes in prometheus 3.5.2:r0
Package prometheus version 3.5.2:r0 fixes 6 vulnerabilities: ghsa-p77j-4mvh-x3m3, ghsa-w8rr-5gcm-pp58, ghsa-hfvc-g4fc-pqhx, CVE-2026-39882, CVE-2026-39883...
EUVD-2026-50973
When enabling Spring Boot DevTools support for a remote application target for example a Docker container or Cloud Foundry app from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret w...
PT-2026-66405
Name of the Vulnerable Software and Affected Versions Spring Tools for Eclipse versions prior to 5.2.1 Description The Boot Dashboard Docker integration publishes container control ports on all host network interfaces 0.0.0.0 instead of restricting them to the loopback interface. This configurati...
CVE-2026-66437
Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...
CVE-2026-66437
Contributor Server Side Request Forgery SSRF in Feedzy = 5.2.4 versions...
Plone 5.2.x < 5.2.14 / 6.0.x < 6.0.7 Multiple Vulnerabilities (HF 20230921)
The version of Plone installed on the remote host is 5.2.x prior to 5.2.14 or 6.0.x prior to 6.0.7. It is, therefore, affected by the following vulnerabilities: - plone.namedfile has a stored cross-site scripting vulnerability for SVG images. CVE-2023-41048 - When the ++api++ traverser in...
EUVD-2026-42321
linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text...