64786 matches found
ROOT-OS-UBUNTU-2404-CVE-2025-68218 CVE-2025-68218 in linux - Patched by Root
Root has patched CVE-2025-68218 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID
The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...
CVE-2026-84221
The Kirki WordPress plugin (versions 6.0.0 - 6.2.5 ) is vulnerable to SQL injection because it fails to escape a user-supplied identifier before incorporating it into a SQL query. This flaw specifically affects the Content Manager Field ID . An attacker with editor-level access or higher can expl...
ROOT-OS-UBUNTU-2204-CVE-2026-23303 CVE-2026-23303 in linux - Patched by Root
Root has patched CVE-2026-23303 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2204-CVE-2026-45949 CVE-2026-45949 in linux - Patched by Root
Root has patched CVE-2026-45949 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2204-CVE-2023-52935 CVE-2023-52935 in linux - Patched by Root
Root has patched CVE-2023-52935 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2204-CVE-2025-39823 CVE-2025-39823 in linux - Patched by Root
Root has patched CVE-2025-39823 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2204-CVE-2024-56692 CVE-2024-56692 in linux - Patched by Root
Root has patched CVE-2024-56692 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2204-CVE-2026-64451 CVE-2026-64451 in linux - Patched by Root
Root has patched CVE-2026-64451 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2204-CVE-2024-40972 CVE-2024-40972 in linux - Patched by Root
Root has patched CVE-2024-40972 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available...
SUSE CVE-2026-43983
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, The createTokenFromRefreshToken function oidcservice.go validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state befor...
SUSE CVE-2026-84185
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption JOSE standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the...
PT-2026-86382
BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and direct-message reviews by enumerating sequential status IDs. Attackers can access the raw content of restricted statuses through the edit...
CVE-2026-86112: Authorization Bypass Through User-Controlled Key
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...
CVE-2026-52774: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...
PT-2026-86473
Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.13 Description An authentication bypass allows unauthenticated attackers to take over accounts. The issue occurs because the pre update value function lacks capability or ownership checks, an...
PT-2026-86383
BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuses they cannot access. Attackers can POST to the favorite endpoint with a status ID to create...
CVE-2026-75586: Improper Neutralization of Input During Web Page Generation
The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formDataid' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
GHSA-8737-QX52-HJFF vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
Summary The /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects and postprocess every nested choices.tokenids list directly. Unlike the normal render/generate path, derender does not enforce model context length, resolved maxtokens,...