5202 matches found
CVE-2026-68417 RDMA/siw: publish QP after initialization
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization siwcreateqp currently calls siwqpadd before the queues, CQ pointers, state, completion, and device list entry are ready. A QPN lookup can therefore reach a QP that is still being...
CVE-2026-18037 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to mak...
CVE-2026-16992 Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication
The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it...
CVE-2026-16992
CVE-2026-16992 affects the WordPress plugin “Create by Mediavine”
CVE-2026-48047
XWiki Platform WebJars API is a package for XWiki, a generic wiki platform. Starting with version 9.6-rc-1 and prior to versions 16.10.17, 17.4.9, and 17.10.3, a potential path traversal vulnerability allow an attacker who manages to get a malicious WebJar extension installed on the wiki to write...
CVE-2026-68742
creationtimestamp| type| source ---|---|--- 2026-08-07 14:05:27+00:00| published-proof-of-concept| https://t.me/bdufstecru/3369 2026-08-08 00:06:20+00:00| published-proof-of-concept| https://t.me/bdufstecru/3369...
CVE-2026-71192
creationtimestamp| type| source ---|---|--- 2026-08-05 17:38:10+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/7mq5ik4363ci5...
GHSA-7PGQ-CR25-XVC8
creationtimestamp| type| source ---|---|--- 2026-08-05 16:00:04+00:00| published-proof-of-concept| https://t.me/bdufstecru/3364 2026-08-06 00:00:34+00:00| published-proof-of-concept| https://t.me/bdufstecru/3364...
CVE-2026-71238
creationtimestamp| type| source ---|---|--- 2026-08-05 11:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msdgn2laot2o...
GHSA-69XF-PQRW-596X
creationtimestamp| type| source ---|---|--- 2026-08-04 07:00:04+00:00| published-proof-of-concept| https://t.me/bdufstecru/3360 2026-08-05 00:00:52+00:00| published-proof-of-concept| https://t.me/bdufstecru/3360...
GHSA-F7VP-7XGX-4W4R
creationtimestamp| type| source ---|---|--- 2026-08-04 02:31:57+00:00| seen| https://gist.github.com/alon710/4e720b413fb9ae4a89b2607de953bdbe...
CVE-2026-16563
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...
EUVD-2026-52183
The Academy LMS WordPress plugin before 3.8.3 does not verify course enrollment or lesson publication status when returning a single lesson through its REST API, allowing users with a self-service student Subscriber-level account to disclose the content of arbitrary lessons, including lessons of...
CVE-2026-16064
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...
EUVD-2026-51950
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...
EUVD-2026-51559
The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in testsqlstringliterallint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and...
CVE-2026-66408
creationtimestamp| type| source ---|---|--- 2026-07-31 04:45:30+00:00| seen| https://jvn.jp/en/vu/JVNVU92804348...
CVE-2026-62325
creationtimestamp| type| source ---|---|--- 2026-07-28 22:35:41+00:00| published-proof-of-concept| https://github.com/goshs-labs/goshs/security/advisories/GHSA-rjrw-mjq6-hpmm 2026-07-28 23:52:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrqm5cwt5q2y 2026-07-29...
DEBIAN-CVE-2026-50735
pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogic...