9096 matches found
PT-2026-78609
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description Remote attackers can execute arbitrary commands due to improper neutralization of shell metacharacters within DHCP options. This occurs when the system fails to properly...
PT-2026-78342
Name of the Vulnerable Software and Affected Versions Outranking Plugin versions prior to 1.1.4 Description Broken access control allows unauthenticated users to access the options of the Outranking Plugin. Recommendations Update to a version newer than 1.1.3...
CVE-2026-18466: Improper Access Control
The WP Maps WordPress plugin before 4.9.8 does not perform a capability check, nor validate a nonce, in one of its AJAX actions, allowing users with a Subscriber account to create an unlimited number of options in the database, each of which is loaded on every page request...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: dracut (UTSA-2026-102692)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102692 advisory. A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious...
PT-2026-78690
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...
CVE-2026-73385: Missing Authorization
Unauthenticated Broken Access Control in Outranking Plugin Options = 1.1.3 versions...
CVE-2026-73181
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
ANT-2026-66X46XSC · supabase/supabase · other
other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-66X46XSC: X-Content-Type-Options header set to invalid value The Next.js headers configuration for the Supabase...
CVE-2026-73181
Extra Product Options & Add-Ons for WooCommerce plugin versions below 7.6 allow unauthenticated attackers to download arbitrary files, exposing sensitive data with CVSS 7.5 (HIGH). PatchStack reports the flaw; no exploit code is provided. Upgrade to version 7.6 or later to remediate. Exploitation...
EUVD-2026-60937
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
CVE-2026-73181 WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
CVE-2026-73181 WordPress Extra Product Options & Add-Ons for WooCommerce plugin < 7.6 - Arbitrary File Download vulnerability
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
CVE-2026-73181
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
UBUNTU-CVE-2026-74978
Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
WordPress WP Compress plugin <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability
Cross-Site Request Forgery to Arbitrary Options Deletion vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WP Compress versions = 7.10.09...
WordPress ShortPixel Adaptive Images plugin <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter vulnerability
Missing Authorization to Authenticated Subscriber+ Third-Party Plugin Option Modification via 'causer' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin ShortPixel Adaptive Images versions = 3.11.5...
WordPress Query Wrangler plugin <= 1.5.57 - Authenticated (Subscriber+) Remote Code Execution via 'options' Parameter vulnerability
Authenticated Subscriber+ Remote Code Execution via 'options' Parameter vulnerability discovered by Enis - TURKOL YAZILIM in WordPress Plugin Query Wrangler versions = 1.5.57...
SUSE CVE-2026-19730
The 'podman quadlet install --replace' command opens the existing destination file with OCREATE|OWRONLY but omits OTRUNC. When the initial reflink copy attempt fails common on non-reflink-capable filesystems including many RHEL default XFS configurations, the fallback in ReflinkOrCopy uses io.Cop...
SUSE CVE-2026-70455
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N...