58239 matches found
CVE-2026-8944 Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter
The Plugin for Google Analytics by IO technologies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the Google Analytics settings page ga.php. This makes it possible for unauthenticated...
CVE-2026-8944
The Plugin for Google Analytics by IO technologies plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the Google Analytics settings page ga.php. This makes it possible for unauthenticated...
CVE-2026-8944
The CVE-2026-8944 affects the WordPress plugin IO Technologies’ Google Analytics plugin (versions
CVE-2026-5430
creationtimestamp| type| source ---|---|--- 2026-06-30 02:45:20+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mphych4fat27 2026-08-06 08:34:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gdxntzqkx3yrb 2026-08-06 09:00:30+00:00| seen|...
DEBIAN-CVE-2026-58302
rtapiapp in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. It is installed SUID root and loads shared library modules via dlopen by using a user-supplied module name. Insufficient validation of the module name allows path traversal, enabling an unprivileged local user to lo...
PT-2026-53812
Name of the Vulnerable Software and Affected Versions Plugin for Google Analytics by IO technologies versions prior to 1.2 Description Cross-Site Request Forgery occurs on the Google Analytics settings page 'ga.php' due to missing or incorrect nonce validation. A nonce is a unique token used to...
FreeBSD-SA-26:39.execve
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-26:39.execve Security Advisory The FreeBSD Project Topic: Local privilege escalation via execve2 TOCTOU race Category: core Module: execve Announced: 2026-06-30...
PT-2026-54023
Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2 Description An issue exists in the middlewareKey function where the system accepts the client-controlled x-limited-key-id header without validating ownership. This allows authenticated users to adopt limited ke...
PT-2026-53997
Name of the Vulnerable Software and Affected Versions yudao-cloud versions prior to 2026.06 Description A broken access control issue exists in the BPM module. An authenticated user can access arbitrary process instance records by providing a caller-controlled process-instance identifier to an...
Linux Distros Unpatched Vulnerability : CVE-2026-13573
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in llvm llvm-project up to 22.1.6. This affects the function llvm::StringMap::insert in the library /lib/IR/ValueSymbolTable.cpp of th...
PT-2026-53894
Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description In the extract function of the Tarfile module, the filter parameter is not correctly handled when extracting hardlinks. This issue allows a system extracting content from untrusted tar files t...
PT-2026-53931
Name of the Vulnerable Software and Affected Versions CVAT versions prior to 2.69.0 Description An improper authorization issue exists in the QualityReportViewSet.get queryset function. Authenticated attackers can enumerate quality report identifiers from other organizations by exploiting a missi...
PT-2026-53843
Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 Apache ActiveMQ Web Console versions prior to 5.19.8 Apache ActiveMQ Web Console versions 6.0.0 through 6.2.6 Description An issue exists where the browse pa...
CVE-2026-52760
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web Console. The browse page in the web console renders a message Id directly without sanitization. This allows an authenticated producer to send a message with a J...
CVE-2026-55956
creationtimestamp| type| source ---|---|--- 2026-06-29 22:38:43+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mphkji2ejb2s 2026-06-29 23:02:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphltgcvtn24 2026-06-29 23:19:22+00:00| seen|...
CVE-2026-43735
creationtimestamp| type| source ---|---|--- 2026-06-29 22:25:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphjsgcsdp2y 2026-07-01 02:50:28+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818 2026-07-01 16:01:00+00:00| seen|...
CVE-2026-56017
creationtimestamp| type| source ---|---|--- 2026-06-29 22:01:16+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mphigjaxpm2d 2026-06-29 22:37:30+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphkhbvg2r2o 2026-06-29 23:50:11+00:00| seen|...
CVE-2026-54818
creationtimestamp| type| source ---|---|--- 2026-06-29 21:16:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mphfvqu4o72j...
CVE-2026-57498 Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId$teamId before any operation. However, multiple Livewire web UI components accept...