18376 matches found
Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution
Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin = 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve...
Kentico Xperience 13 CMS - Staging Service Authentication Bypass (WT-2025-0006)
An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handling for the server defined None type. Authentication bypass allows an attacker to control administrative objects.This issue affects Xperience through...
JoomSport <= 5.7.7 - SQL Injection
The JoomSport WordPress plugin through 5.7.7 is vulnerable to unauthenticated time-based blind SQL injection via the 'sortf' GET parameter in the player list view. The parameter value is backtick-wrapped and directly concatenated into an ORDER BY clause. id: CVE-2026-42647 info: name: JoomSport =...
ROOT-OS-UBUNTU-2404-CVE-2025-71192 CVE-2025-71192 in linux - Patched by Root
Root has patched CVE-2025-71192 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
Security Bulletin: This Power System update is being released to address CVE-2026-22796
Summary PowerVM relies on OpenSSL to support a range of features, such as virtual TPM, LPM, and other functionalities that require cryptographic operations. This bulletin provides a remediation for the impacted vulnerability, CVE-2026-22796 by upgrading PowerVM and thus addressing the exposure to...
EUVD-2026-55490
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5...
CVE-2026-21082
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
EUVD-2026-55107
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21082
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21082
The CVE-2026-21082 entry identifies a relative path traversal vulnerability in Samsung Health prior to version 7.0.0, allowing local attackers to access sensitive information. Affected software: Samsung Health (pre-7.0.0). Root cause: relative path traversal. Impact: confidentiality of data may b...
CVE-2026-21077
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21077
Samsung Health is affected by CVE-2026-21077 due to incorrect authorization prior to version 7.0.0, allowing local attackers to access sensitive information. Affected software: Samsung Health (versions
CVE-2026-21076
Samsung Health prior to version 7.0.0 has an incorrect authorization flaw that could allow local attackers to access sensitive information. Affected product: Samsung Health (pre-7.0.0). Root cause: improper access control enabling local access to data. Reported CVSS v4.0 base score 6.9 (MEDIUM) w...
CVE-2026-21076
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21076
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-14211
The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee provider is related to the customer whose record is being accessed, allowing any employee with an Employee Panel login to read and modify the stored personal data of any...
Astra Linux – Vulnerability in Squid
Squid is a caching proxy for the Web. Prior to version 7.5, due to heap use-after-free issues, Squid was vulnerable to Denial of Service attacks when handling ICP traffic. This vulnerability allowed a remote attacker to carry out a reliable and repeatable Denial of Service attack on the Squid...
Astra Linux – Vulnerability in Python 3.11
The email module, specifically the “BytesGenerator” class, did not properly quote newlines for email headers when serializing an email message. This issue occurs only when using “LiteralHeader” to write headers that do not follow email folding rules. The new behavior will reject incorrectly folde...
Astra Linux – Vulnerability in Python 3.11
The poplib module, when a user-controlled command is passed to it, can have additional commands injected using newlines. Mitigation rejects commands that contain control characters...