92234 matches found
CVE-2026-57665: Authorization Bypass Through User-Controlled Key
Unauthenticated Insecure Direct Object References IDOR in GravityView = 3.0.0 versions...
CVE-2026-57430: Missing Authorization
Contributor Broken Access Control in SEOPress PRO = 9.1.1 versions...
CVE-2026-56058: Unrestricted Upload of File with Dangerous Type
Subscriber Arbitrary File Upload in Quform = 2.23.0 versions...
CVE-2026-57622: Missing Authorization
Subscriber Broken Access Control in WPCafe = 3.0.14 versions...
CVE-2026-57645: Missing Authorization
newsletterssubscribers Broken Access Control in Newsletters = 4.13 versions...
CVE-2026-57648: Missing Authorization
Contributor Broken Access Control in Nelio Content = 4.3.4 versions...
CVE-2026-54448 Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser
Trivy is a security scanner. Prior to 0.71.0, when Trivy scans a Helm chart archive .tgz, its custom tar unpacker reads each entry with io.ReadAlltr and no size limit. An attacker who can place a malicious .tgz file in the scanned path can craft a small compressed archive that decompresses to...
CVE-2026-57587
A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS records for a scanned host to inject malicious SQL into the scan results database, potentially enabling exfiltration of scan-result data...
Ingram-Pro
Ingram-Pro Network Camera Vulnerability Scanner Enhanced E...
Exploit for Improper Check for Unusual or Exceptional Conditions in Mozilla Firefox
🚨 CVE-2024-4367 - Universal PDF.js Vulnerability Scanner...
Website-Vulnerability--Scan
Website-Vulnerability--Scan...
WebPentest
🕷️ WebPentest — Web Application Penetration Testing Tool Au...
CVE-2026-11703: Improper Authentication
Missing SNI/ALPN binding on stateful session-ID resumption, which previously skipped the binding check performed for ticket-based resumption. A cached session could be resumed under a different SNI/ALPN than originally negotiated and, where client-authentication policy differs across virtual host...
CVE-2026-54842: Missing Authorization
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25...
CVE-2026-54848: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3...
CVE-2026-54090: Improper Neutralization of Special Elements used in a Command
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when a shell interpreter is configured e.g. /bin/sh -c, the command allowlist can be bypassed through shell metacharacters. The allowlist...
Linux Distros Unpatched Vulnerability : CVE-2026-53052
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ASoC: qcom: qdsp6: topology: check widget type before accessing data Check widget type before accessing the private data, as this could a virtual widget which i...
CVE-2026-6092: Selection of Less-Secure Algorithm During Negotiation
When HAVEENCRYPTTHENMAC is configured, the implementation could fall back to MAC-then-Encrypt rather than enforcing Encrypt-then-MAC...
CVE-2026-55960: Improper Certificate Validation
Un-negotiated Raw Public Key RFC 7250 accepted in place of an X.509 certificate, bypassing chain validation. A raw public key has no chain, so ParseCertRelative accepts it without performing any trust verification; it must therefore only be accepted when RPK was actually negotiated for that peer...