256336 matches found
SUSE SLES15: Multiple Vulnerabilities (SUSE-RU-2026:3712-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- RU-2026:3712-1 advisory. Release Notes Highlights: - Update to SUSE Multi-Linux Manager 5.1.5 Added known issue for missing BasicConstraints Critical flag Added a note about...
PT-2026-98992
JupyterLab pip package 'jupyterlab' versions =4.1.0,=4.6.0,=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or...
The vulnerability of the package manager for Kubernetes Helm, related to unvalidated array indexing, allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the package manager for Kubernetes Helm is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...
Adobe Experience Manager Forms JEE <= 6.5.25 / 6.5 LTS SP2 Multiple Vulnerabilities (APSB26-151)
The version of Adobe Experience Manager Forms JEE installed on the remote host is 6.5.25 or earlier, or 6.5 LTS SP2 or earlier. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-151 advisory. - Adobe Experience Manager Forms JEE is affected by an Incorrect...
CVE-2026-86066: Cross-Site Request Forgery (CSRF)
Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...
CVE-2026-100192: Missing Authentication for Critical Function
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...
CVE-2026-85542: Improper Neutralization of Special Elements used in an OS Command
IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the GIM bundle import functionality. An authenticated attacker can provide a crafted GIM bundle that causes attacker-controlled arguments to be passed to the tar command, resulting in arbitrary command execution...
SUSE SLES15: Multi-Linux-Manager-Server-SLE-release / mgradm / etc (SUSE-SU-2025:3839-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:3839-1 advisory. Multi-Linux-Manager-Server-SLE-release: - Update for the release packages for fixing the EOL - Fixed migration issue bsc1243486 server-attestation-imag...
PT-2026-98506
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The in-kernel MPTCP path manager contains an asymmetry between removal paths that can leave a stale ADD ADDR announcement entry active when removing the id 0 endpoint. This occurs becaus...
CVE-2026-71540 Wazuh Manager cluster header parsing allows pre-authentication memory exhaustion
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14.7, wazuh-clusterd in framework/wazuh/core/cluster/common.py allocates a payload buffer using the size declared in a 20-byte cluster protocol header before...
WordPress Pixel Manager for WooCommerce plugin <= 1.69.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin Pixel Manager for WooCommerce versions = 1.69.0...
WordPress Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Mor Golan in WordPress Plugin Blacklist Manager WooCommerce Anti-Fraud, Blacklist & Checkout Verification versions = 2.3.1...
Important: Red Hat Security Advisory: yggdrasil-worker-package-manager security update
An update for yggdrasil-worker-package-manager is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...
CVE-2026-93662
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
CVE-2026-93661
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event...
CVE-2026-93662 Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
CVE-2026-93662
The Events Manager WordPress plugin, in versions prior to 7.4.5 , is vulnerable to an unauthorized data disclosure flaw. The application fails to enforce proper scope for logged-in event and location searches when a caller provides a custom owner value . This allows a low-privileged user to read ...
CVE-2026-93661
The Events Manager WordPress plugin (versions prior to 7.4.5 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to prevent a ticket-update request from replacing the original ticket identifiers used during authorization. This allows a user with permission to mana...
CVE-2026-93661 Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event...
CVE-2026-93662 Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...