3663 matches found
GHSA-VP88-798V-H67F vulnerabilities
Vulnerabilities for packages: zizmor, zellij, lychee, buck2, efs-utils, symbolicator-fips, cloud-hypervisor, kcl-lib, sentry-relay, wasmcloud, sccache, samply, symbolicator, wadm, cleave, qdrant, cargo-audit, ascan, sentry-relay-fips, ntpd-rs, kdash...
GHSA-H2V8-394M-P7VV vulnerabilities
Vulnerabilities for packages: zizmor, zellij, lychee, buck2, efs-utils, symbolicator-fips, cloud-hypervisor, komodo, kcl-lib, sentry-relay, ztunnel, wasmcloud, sccache, samply, symbolicator, wadm, cleave, qdrant, vector, cargo-audit, ascan, sentry-relay-fips, ntpd-rs, kdash, garage...
CVE-2026-106648
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...
EUVD-2026-111971
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...
PT-2026-129192
OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader that allows unauthenticated attackers to stall connections by sending payload length values above 32750. Attackers can send crafted OVT packets to the OVT listener to hold connections open...
PT-2026-128088
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...
CVE-2026-106648: Unknown Royal Elementor Addons: The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before…
The Royal Elementor Addons WordPress plugin before 1.7.1070 does not validate submitted form field values before substituting them into the recipient addresses of its form notification emails, allowing unauthenticated attackers to replace the recipient list and relay attacker-composed email from...
Updated weechat package fixes security vulnerabilities
Decompression Bomb in Relay WebSocket DoS. CVE-2026-53524 Non-Constant-Time Password Hash Comparison in Relay Authentication. CVE-2026-53525...
MGASA-2026-0561 Updated weechat package fixes security vulnerabilities
Decompression Bomb in Relay WebSocket DoS. CVE-2026-53524 Non-Constant-Time Password Hash Comparison in Relay Authentication. CVE-2026-53525...
CVE-2026-26128 SMB Relay Privesc (from shell)
Post-exploitation wrapper for CVE-2026-26128: reads domain identity from an active Windows shell session, then launches the ADIDNS Unicode hostname + Kerberos coercion + SMB relay chain. Operator must still supply password, listener IP, and relay target AD CS or MSSQL. !/usr/bin/env python3 --...
Next.js CVE-2024-34351 Server Actions SSRF
CVE-2024-34351 Next.js 13.4.0–14.1.0: Host-header Server Action redirect SSRF. Starts a local relay HEAD text/x-component, GET 302 to internalurl and POSTs with Next-Action to fetch internal content. !/usr/bin/env python3 -- coding: utf-8 -- """Next.js CVE-2024-34351 Server Actions SSRF via...
OPENSUSE-SU-2026:22189-1 Security update for shadowsocks-rust, shadowsocks-libev
This update for shadowsocks-rust, shadowsocks-libev fixes the following issues: Changes in shadowsocks-rust: - Fix SELinux denial nameconnect when forwarding outbound TCP traffic boo1284975 - Fix: Unable to bind ports below 1024 with SELinux enabled boo1284025 - Update version to 1.25.0 Allow...
CVE-2026-77058
boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...
CVE-2026-77058 Cross-Site Request Forgery (CSRF) in boneIO
boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...
CVE-2026-77058
boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints. The root cause is the absence of CSRF tokens and a failure to validate Origin or Referer headers. A remote attacker can lure a user on the internal network to a malicious webpage that sends cross-...
CVE-2026-77058 Cross-Site Request Forgery (CSRF) in boneIO
boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...
CVE-2026-77058 Cross-Site Request Forgery (CSRF) in boneIO
boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...
PT-2026-123363
boneIO Black is vulnerable to Cross-Site Request Forgery CSRF on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin...
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws. "What researchers saw was an attack against a European government agency executed in th...
CVE-2026-53986
Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...