19115 matches found
PT-2026-50635
The CF7 to Webhook plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.0 via the pull the trigger. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can ...
ROS-20260618-73-0014
The vulnerability in ImageMagick7 is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20260618-73-0017
The vulnerability in ImageMagick 7 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2026-50791
Name of the Vulnerable Software and Affected Versions Guzzle versions prior to 7.12.1 Description In certain configurations, traffic intended to be protected by TLS on the hop to the proxy is transmitted in cleartext. This occurs when an application uses the built-in cURL handlers...
ROS-20260618-73-0023
The vulnerability in ImageMagick 7 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2026-50793
Name of the Vulnerable Software and Affected Versions Guzzle versions prior to 7.12.1 Description CookieJar incorrectly accepts cookies with a dot-only Domain attribute such as Domain=., Domain=.., Domain=... and whitespace-padded variants. The SetCookie::matchesDomain function removes leading...
ROS-20260618-73-0027
The vulnerability in ImageMagick 7 is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-50668
UBB.threads is vulnerable to Stored XSS via user posts and user profile fields. The application fails to properly sanitize user input, allowing low privileged attackers to inject arbitrary JavaScript that executes in a victim's browser upon viewing. Because vendor contact attempts were...
ROS-20260618-73-0025
The vulnerability in ImageMagick 7 is related to uncontrolled recursion. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-50672
UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any file on the application’s server that application has privileges to, what results in Remote Code Execution. Because vendor contact attempts were unsuccessful, the vulnerability...
ROS-20260618-73-0033
The vulnerability in ImageMagick7 is related to incorrect calculations. Exploiting this vulnerability can allow an attacker to cause a service failure...
DEBIAN-CVE-2026-48990
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. In versions 1.3.4 through 1.6.5, joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength, which can lead to resource exhaustion...
CVE-2026-8050
The SignalRGB kernel driver, SignalIo.sys (or SignalRgbDriver.sys), is vulnerable to a NULL pointer dereference in versions prior to 1.3.7.0 . Specifically, seven of the sixteen IOCTL handlers fail to verify that the SystemBuffer pointer is non-NULL before dereferencing it. An authenticated local...
CVE-2026-48814
Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions
CVE-2026-48814 Network-AI: Empty default secret still authorizes all requests (Incomplete fix for CVE-2026-46701)
Network-AI is a TypeScript/Node.js multi-agent orchestrator. In versions 5.7.1 and earlier, the MCP SSE server allows unauthenticated cross-origin MCP tool invocation due to an empty default secret. This issue was partially addressed by CVE-2026-46701 in version 5.4.5 by closing the CORS flaw wit...
EUVD-2026-37630
Subscriber SQL Injection in Cornerstone 7.8.8 versions...
EUVD-2026-37496
Unauthenticated SQL Injection in wpDataTables = 7.3.6 versions...
EUVD-2026-37494
Unauthenticated Cross Site Scripting XSS in Enfold = 7.1.4 versions...