4516 matches found
CVE-2026-19404
A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled the default, or any authenticated...
CVE-2026-56848
A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing. Mitigation Restrict netwo...
WordPress Simple Restrict plugin < 1.2.9 - Contributor+ Restricted Content Disclosure vulnerability
Contributor+ Restricted Content Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Simple Restrict versions 1.2.9...
WordPress Membership Plugin – Kadence Memberships plugin <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover vulnerability
Unauthenticated Password Reset Link Poisoning to Account Takeover vulnerability discovered by scort in WordPress Plugin Restrict Content versions = 4.0.0...
CVE-2026-61483
UNSUPPORTED WHEN ASSIGNED Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to...
CVE-2026-61484
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the...
EUVD-2026-53191
UNSUPPORTED WHEN ASSIGNED Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance ...
CVE-2026-61486
UNSUPPORTED WHEN ASSIGNED Stack-based Buffer Overflow vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance ...
CVE-2026-61484 Apache Lucy: LucyX::Remote::SearchServer unauthenticated remote Storable::thaw -> RCE/DoS
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the...
EUVD-2026-53168
UNSUPPORTED WHEN ASSIGNED Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to...
CVE-2026-61483
UNSUPPORTED WHEN ASSIGNED Uncontrolled Recursion vulnerability in Apache Lucy. This issue affects Apache Lucy: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to...
MAL-2026-11915 Malicious code in @servicetitan/restrict-imports (npm)
npm/@servicetitan/restrict-imports is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @servicetitan/restrict-imports (npm)
npm/@servicetitan/restrict-imports is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
CVE-2026-15939
The Simple Restrict WordPress plugin (versions before 1.2.9 ) is vulnerable to a Restricted Content Disclosure flaw. The root cause is an incorrect authorization mechanism where the plugin fails to enforce its specific content-restriction permission checks on the REST API , relying instead on a g...
CVE-2026-15939 Simple Restrict < 1.2.9 - Contributor+ Restricted Content Disclosure via REST API
The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing...
CVE-2026-15939: Incorrect Authorization
The Simple Restrict WordPress plugin before 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end, relying there on a generic capability check instead of the Simple Restrict WordPress plugin before 1.2.9's own permission system, allowing...
CVE-2026-55995
A flaw was found in open-iscsi. An unauthenticated man-in-the-middle MITM attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service DoS condition, making the affected system unavailable. Mitigation If the iSNS service is not actively used...
GHSA-5JMR-GCRJ-2C9Q LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
Impact LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives. An authenticated user with access to LiteLLM LLM API routes, or a key whose allowedroutes includes /v1/skills, anthropicroutes, or llmapiroutes, could upload a crafted skill archive...
Authorization Bypass Through User-Controlled Key
Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the SSO instance-role provisioning. An attacker can gain full administrative privileges by manipulating the instance-role claim issued by the...