19113 matches found
PT-2026-63891
Unauthenticated Broken Access Control in AWP Classifieds = 4.4.7 versions...
PT-2026-63943
Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...
PT-2026-63884
Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...
A Bootiful Podcast: Java Developer Advocate Billy Korando on Java 27 and Beyond
Hi Spring fans! In this installment, I am thrilled to have the chance to sit down with Java Developer Advocate Billy Korando to talk about the amazing features in the upcoming Java 27! We recorded this a day before I flew to San Francisco to attend the world premiere of the Java documentary, so a...
PT-2026-63951
Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...
PT-2026-63834
Unauthenticated Arbitrary File Deletion in Broadcast Live Video = 7.2.4 versions...
PT-2026-63908
Unauthenticated Broken Access Control in Photography = 7.7.6 versions...
PT-2026-64170
Name of the Vulnerable Software and Affected Versions victor Web versions prior to 7.1 Description Johnson Controls victor Web on Windows contains an issue related to improper privilege management CWE-269, which may allow privilege escalation CAPEC-233. Recommendations Update victor Web to versio...
PT-2026-63804
Author Server Side Request Forgery SSRF in Photo Block = 1.7.1 versions...
Oracle VM VirtualBox (July 2026 CPU)
The 7.2.12 version of VM VirtualBox installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12...
CVE-2026-57214 affecting package rabbitmq-server for versions less than 3.13.7-7
CVE-2026-57214 affecting package rabbitmq-server for versions less than 3.13.7-7. A patched version of the package is available...
GHSA-4MP9-239F-G9HG Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
Summary An attacker can force WebSocket upgrade via the lax V07 or V08 handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request...
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
Summary An attacker can force WebSocket upgrade via the lax V07 or V08 handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request...
WordPress Premium Packages – Sell Digital Products Securely plugin <= 7.0.4 - Authenticated (Admin+) SQL Injection vulnerability
Authenticated Admin+ SQL Injection vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin WPDM – Premium Packages versions = 7.0.4...
Allocation of Resources Without Limits or Throttling
Overview elgg/elgg is a development framework used for creating socially aware web applications. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the avatar upload process. An attacker can cause resource exhaustion by uploading an image...
CVE-2026-65650
Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload...
WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Cross Site Scripting (XSS) vulnerability
WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme = 7.5.4 - Cross Site Scripting XSS vulnerability discovered by ed32.dll in WordPress Theme Manual - Documentation, Knowledge Base & Education WordPress Theme versions = 7.5.4...
MINI-JHCX-7R22-5CP6
Bulletin has no description...
CVE-2026-65012 InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder
InvokeAI before 6.13.7 contains an unauthenticated directory enumeration vulnerability in the GET /api/v2/models/scanfolder endpoint that accepts attacker-controlled scanpath parameters. Unauthenticated attackers can recursively enumerate arbitrary server filesystem directories and use HTTP...
