736 matches found
MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal
MPDV Mikrolab GmbH HYDRA X, MIP 2, and FEDRA 2 = Maintenance Pack 36 with Servicepack 8 week 36/2025 contain an unauthenticated local file disclosure vulnerability caused by improper validation of the "Filename" parameter in the public $SCHEMAS$ resource, letting attackers read arbitrary Windows ...
CVE-2026-68508
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate resolves and calls Python objects selected by configuration through resolvetarget in hydra/internal/instantiate/instantiate2.py, allowing attacker-controlled target values and arguments to...
CVE-2026-68508
Hydra (Python configuration framework) prior to 1.3.4 is vulnerable to arbitrary code execution via hydra.utils.instantiate(). The function resolves and calls Python objects selected by configuration through _resolve_target(), allowing attacker-controlled target values and arguments to invoke dan...
CVE-2026-68508 Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate resolves and calls Python objects selected by configuration through resolvetarget in hydra/internal/instantiate/instantiate2.py, allowing attacker-controlled target values and arguments to...
EUVD-2026-64130
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate resolves and calls Python objects selected by configuration through resolvetarget in hydra/internal/instantiate/instantiate2.py, allowing attacker-controlled target values and arguments to...
CVE-2026-68508 Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate resolves and calls Python objects selected by configuration through resolvetarget in hydra/internal/instantiate/instantiate2.py, allowing attacker-controlled target values and arguments to...
WordPress Hydra Booking plugin <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter vulnerability
Authenticated Host+ Stored Cross-Site Scripting via 'firstname' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Hydra Booking versions = 1.2.2...
CVE-2026-15948
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15948
The CVE-2026-15948 entry concerns the Hydra Booking WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in the first_name parameter for all versions up to and including 1.2.2 due to insufficient input sanitization and output escaping. The tfhb_host role can be self-assigned via t...
CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15948
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-58861
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-72152
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
GO-2026-4807 vulnerabilities
Vulnerabilities for packages: hydra, hydra-fips...
GO-2025-3987 vulnerabilities
Vulnerabilities for packages: hydra, hydra-fips, weaviate...
GO-2026-5028 vulnerabilities
Vulnerabilities for packages: hubble, virt-operator-fips, zot, tenv-fips, commercial-grafana, terraform, crossplane-provider-azure-servicefabric, crossplane-provider-azure-streamanalytics, kubernetes, terraform-provider-acme, etcd, frankenphp-8.3, cilium-envoy-fips, flux, gitea, nemo, hydra,...
GO-2026-5027 vulnerabilities
Vulnerabilities for packages: hubble, virt-operator-fips, zot, tenv-fips, commercial-grafana, terraform, crossplane-provider-azure-servicefabric, crossplane-provider-azure-streamanalytics, kubernetes, terraform-provider-acme, etcd, frankenphp-8.3, cilium-envoy-fips, flux, gitea, nemo, hydra,...
GO-2026-5029 vulnerabilities
Vulnerabilities for packages: hubble, virt-operator-fips, zot, tenv-fips, commercial-grafana, terraform, crossplane-provider-azure-servicefabric, crossplane-provider-azure-streamanalytics, kubernetes, terraform-provider-acme, etcd, frankenphp-8.3, cilium-envoy-fips, flux, gitea, nemo, hydra,...
