629270 matches found
CVE-2026-16582
The Booking for Appointments and Events Calendar – Amelia WordPress plugin is vulnerable to unauthenticated payment bypass in versions up to and including 2.4.5 . The root cause is that the plugin accepts a client-supplied package-redemption identifier as proof of payment without properly validat...
CVE-2026-16582 Booking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 2.4.5. This is due to the plugin accepting a client-supplied package-redemption identifier as proof of payment without validating...
DEBIAN-CVE-2026-52727
lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...
CVE-2026-52727
lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...
AZL-102794 CVE-2026-90137 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...
CVE-2026-90137
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...
DEBIAN-CVE-2026-90137
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...
CVE-2026-54575 mport package fetch and clean paths are vulnerable to TOCTOU filesystem races
mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...
CVE-2026-54586 mport permits repository and package mirror fetches over insecure transport
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...
CVE-2026-54586 mport permits repository and package mirror fetches over insecure transport
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...
CVE-2026-54586 mport permits repository and package mirror fetches over insecure transport
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...
EUVD-2026-82324
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchindex, mportfetchbootstrapindex, and mportfetchbundle paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a urlishttps enforcement check. When a cleartext URL was configured or returned by...
CVE-2026-54586
CVE-2026-54586 affects mport , the MidnightBSD Package Manager . Prior to version 2.7.8 , the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. Wh...
CVE-2026-54580 mport index decompression can leave partial or corrupt index data after zstd failures
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...
CVE-2026-54582 mport package installation can overwrite existing unmanaged or differently owned files
mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/checkpreconditions.c, libmport/installprimative.c, and libmport/mportprivate.h did not apply...
CVE-2026-90137
CVE-2026-90137 is an out-of-bounds read in the hp-bioscfg platform driver of the Linux kernel. The PSWD_ENCODINGS parser reads password_obj[elem + pos_values] while copying supported password encodings from an ACPI package, but lacks a bounds check on the computed index. A malformed ACPI package ...
CVE-2026-90137 platform/x86: hp-bioscfg: fix password encoding bounds check
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...
EUVD-2026-81730
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...
GHSA-6FVH-FGMG-3X7V Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses...
GO-2026-6444 vulnerabilities
Vulnerabilities for packages: nerdctl-fips, tigera-operator, steampipe, envoy-gateway-fips, neuvector, gitlab-rails-ce, docker-cli-buildx, syft, google-osconfig-agent, chainctl, consul-k8s, chartmuseum-fips, kargo, k8sgpt, dagger, teleport, helm-exporter, kubevela-fips, neuvector-fips, syft-fips,...