203291 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-90773
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute...
CVE-2026-90560
zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the en...
CVE-2026-90554
vLLM versions =0.10.2 and 0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nanonemotronvl.py, extractaudiofromvideos calls loadaudiopyavBytesIOvideobytes without the maxdurations or maxdecodebytes parameters, so neith...
EUVD-2026-76874
The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'loadmanually' parameter in the render...
CVE-2026-90554
A flaw was found in vLLM. This vulnerability allows a remote attacker to cause a denial of service by providing a specially crafted, highly compressed video as multimodal input when the NanoNemotronVL model is configured to use audio from video. The lack of proper size or duration limits during...
EUVD-2026-76872
vLLM versions =0.10.2 and 0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nanonemotronvl.py, extractaudiofromvideos calls loadaudiopyavBytesIOvideobytes without the maxdurations or maxdecodebytes parameters, so neith...
CVE-2026-90554 vLLM before 0.28.0 Denial of Service via audio extraction
vLLM versions =0.10.2 and 0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nanonemotronvl.py, extractaudiofromvideos calls loadaudiopyavBytesIOvideobytes without the maxdurations or maxdecodebytes parameters, so neith...
CVE-2026-90554 vLLM before 0.28.0 Denial of Service via audio extraction
vLLM versions =0.10.2 and 0.28.0 do not apply any audio decode-size or duration limit when extracting audio from video input for NanoNemotronVL models. In nanonemotronvl.py, extractaudiofromvideos calls loadaudiopyavBytesIOvideobytes without the maxdurations or maxdecodebytes parameters, so neith...
CVE-2026-80491
The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks...
EUVD-2026-76808
The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-80491
The SAMO Forms WordPress plugin, version 1.0.0 and below, is vulnerable to SQL injection because it fails to properly sanitise and escape user input. This flaw exists within several unauthenticated actions , allowing remote attackers to execute unauthorized SQL queries. The vulnerability has been...
CVE-2026-80491 SAMO Forms <= 1.0.0 - Unauthenticated SQLi
The SAMO Forms WordPress plugin through 1.0.0 does not properly sanitise and escape user input before using it in SQL queries in several unauthenticated actions, allowing unauthenticated attackers to perform SQL injection attacks...
GRANDE-PS4-13.02
ps4 rtsold/CVE-2025-14558 exploits I have not achieved c...
EUVD-2026-76773
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...
CVE-2026-89268 QloApps through 1.7.0 Reflected XSS via List Filter Parameters
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...
CVE-2026-89268 QloApps through 1.7.0 Reflected XSS via List Filter Parameters
QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...
PT-2026-90573
Name of the Vulnerable Software and Affected Versions Custom Menu Wizard Widget WordPress plugin versions prior to 3.3.2 Description Insufficient sanitization and escaping of several shortcode attributes before they are rendered into HTML allows users with contributor-level access and above to...
Linux Distros Unpatched Vulnerability : CVE-2026-89716
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - zram: validate deflate params We must validate user-supplied deflate winbits before we pass it to zlibdeflateworkspacesize, which triggers BUGON if winbits valu...
Linux Distros Unpatched Vulnerability : CVE-2026-83530
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit configured on the CEL environment, and a memory allocation...
Linux Distros Unpatched Vulnerability : CVE-2026-89666
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtim...