130582 matches found
CVE-2026-64127
A flaw was found in the Linux kernel's Bluetooth L2CAP Logical Link Control and Adaptation Protocol component. A paired Bluetooth device could exploit this vulnerability by sending a specially crafted reconfiguration request. This would cause the kernel to inadvertently disclose a portion of its...
CVE-2026-13147
The Kirki WordPress plugin before 6.0.12 does not validate a user-supplied URL before requesting it server-side, allowing unauthenticated attackers to make the site issue HTTP requests to arbitrary hosts Server-Side Request Forgery...
CVE-2026-11349
The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL...
httpd: NULL pointer dereference via specially crafted request
A flaw was found in the moddavlock module of httpd. This vulnerability allows a remote unauthenticated attacker to crash the server due to a NULL pointer dereference via a specially crafted request...
CVE-2026-13432
The ThumbPress WordPress plugin before version 6.2.2 is vulnerable to a missing capability check on one of its AJAX actions . This flaw allows authenticated users with subscriber-level access or higher to deactivate the plugin, which disrupts the website's image-handling functionality. No specifi...
CVE-2026-9833 Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter
The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...
CVE-2026-13156
The MailerSend – Official SMTP Integration WordPress plugin (versions before 1.0.8 ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The flaw exists because the configuration-delete administrative action verifies the manage_options capability but fails to perform WordPress nonce veri...
CVE-2026-11349
The Modern Event Calendar Pro and Modern Events Calendar Lite WordPress plugins (versions prior to 7.34.0) are vulnerable to an unauthenticated SQL injection . The vulnerability is caused by the lack of sanitization and escaping for request parameters used in an AJAX action. Specifically, the mec...
srt -- Multiple vulnerabilities
The SRT project reports: CVE-2026-55869: Heap-Based Buffer Overflow in KMREQ Handling. A remote attacker may be able to trigger a heap-based buffer overflow during key material request processing, leading to a denial of service or potentially arbitrary code execution. CVE-2026-55868: Encryption...
CVE-2026-51026
Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request...
CVE-2026-51026
Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request...
CVE-2026-51031
FlareSolverr before version 3.4.7 contains a server-side request forgery SSRF vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information...
PT-2026-61689
HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to direct the server to make requests to arbitrary internal network destinations by supplying a caller-controlled URL to the webhook test endpoint. Attackers can bypass the insufficie...
PT-2026-61609
Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 Description Low-privileged authenticated users can trigger a Server-Side Request Forgery SSRF, a flaw...
Linux Distros Unpatched Vulnerability : CVE-2026-64094
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Without rtnllock held, a hardif might be retrieved as primary interface of a meshif, but...
TencentOS Server 3: nginx:1.24 (TSSA-2026:0618)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0618 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
Linux Distros Unpatched Vulnerability : CVE-2026-63894
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: serialize DMABUF cancel against request completion...
RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update (Important) (RHSA-2026:42078)
The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42078 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...
PT-2026-67300
Name of the Vulnerable Software and Affected Versions axios versions 0.31.1 through 0.32.x axios versions 1.15.2 through 1.17.x Description In Node.js deployments using the HTTP adapter, a bypass of prototype pollution hardening allows requests to be routed through an attacker-controlled proxy...