2433 matches found
CVE-2026-18817
CVE-2026-18817 affects Baserow up to 2.3.2. The issue involves the function BaserowImpersonateAuthTokenSerializer in backend/src/baserow/api/admin/users/serializers.py (Inactive Non-Staff User Handler). A manipulation may lead to improper authorization and, per the report, remote exploitation is ...
CLSA-2026-1783386123 TuxCare security update for org.springframework (2 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 2 CVEs. Fixed in 5.3.31-tuxcare.6...
CLSA-2026-1780966317 TuxCare security update for io.undertow (4 CVEs)
TuxCare rebuilt 8 io.undertow packages to address 4 CVEs. Fixed in 2.3.0.Final-tuxcare.1...
CLSA-2026-1779065200 TuxCare security update for guzzlehttp/guzzle (5 CVEs)
TuxCare rebuilt guzzlehttp/guzzle to address 5 CVEs. Fixed in 6.3.3-p1+tuxcare...
CLSA-2026-1778805973 TuxCare security update for picomatch (2 CVEs)
TuxCare rebuilt picomatch to address 2 CVEs. Fixed in 2.3.1-tuxcare.1...
CLSA-2026-1775003174 TuxCare security update for underscore.string (1 CVE)
TuxCare rebuilt underscore.string to address 1 CVE. Fixed in 2.3.3-tuxcare.1...
CLSA-2026-1773274564 TuxCare security update for tunnel-agent (1 CVE)
TuxCare rebuilt tunnel-agent to address 1 CVE. Fixed in 0.4.3-tuxcare.1...
CLSA-2026-1773360975 TuxCare security update for ms (2 CVEs)
TuxCare rebuilt ms to address 2 CVEs. Fixed in 0.3.0-tuxcare.1...
CLSA-2026-1772928825 TuxCare security update for debug (1 CVE)
TuxCare rebuilt debug to address 1 CVE. Fixed in 2.3.3-tuxcare.1...
CLSA-2026-1771546208 TuxCare security update for braces (1 CVE)
TuxCare rebuilt braces to address 1 CVE. Fixed in 2.3.2-tuxcare.1...
CLSA-2026-1767917315 TuxCare security update for 13 packages (1 CVE)
TuxCare rebuilt 13 packages to address 1 CVE. Fixed in 4.3.11.Final-tuxcare.1...
CLSA-2025-1760313987 TuxCare security update for org.springframework.webflow (2 CVEs)
TuxCare rebuilt 5 org.springframework.webflow packages to address 2 CVEs. Fixed in 2.3.1.RELEASE-tuxcare.1...
WordPress Travel & Tours Meta Search plugin <= 2.3 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by CraCkEr in WordPress Plugin Flights & Hotels Booking WP Plugin versions = 2.3...
WordPress Travel & Tours Meta Search plugin <= 2.3 - Unauthenticated SQL Injection vulnerability
Unauthenticated SQL Injection vulnerability discovered by CraCkEr in WordPress Plugin Flights & Hotels Booking WP Plugin versions = 2.3...
PT-2026-67074
Name of the Vulnerable Software and Affected Versions Nex Forms – Ultimate Form Builder – Lite versions prior to 9.2.4 Description An arbitrary file deletion issue exists due to path traversal. The delete file AJAX handler retrieves a file path from the database and passes it to the unlink functi...
PT-2026-67131
The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...
Atlassian Confluence 9.0.1 / 9.1.x / 9.2.x < 9.2.17 / 9.3.1 / 9.4.x / 9.5.1 / 10.0.2 / 10.1.x / 10.2.x < 10.2.7 (CONFSERVER-104334)
The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104334 advisory. - This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and...
SUSE CVE-2026-35599
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an On loop that advances a date by the task's RepeatAfter duration until it exceeds the current time. By creating a repeating task with a 1-second interval and a due date far ...
SUSE CVE-2026-35602
Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size field from the JSON metadata inside the import zip instead of the actual decompressed file content length for the file size enforcement check. By...