24677 matches found
CVE-2026-1165
The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publishunpublishpopupbox' function that verifies a self-created nonce rather than one submitted in the request. This mak...
CVE-2026-1165 Popup Box <= 6.1.1 - Cross-Site Request Forgery to Popup Status Change
The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1.1. This is due to a flawed nonce implementation in the 'publishunpublishpopupbox' function that verifies a self-created nonce rather than one submitted in the request. This mak...
GHSA-JFPC-WJ3M-QW2M
creationtimestamp| type| source ---|---|--- 2026-01-31 01:20:51+00:00| seen| https://gist.github.com/alon710/6005675fc930251c9d8000c9e9ab7e40...
GHSA-6JR7-99PF-8VGF
creationtimestamp| type| source ---|---|--- 2026-01-30 23:20:42+00:00| seen| Telegram/pazjypwJ9q5j0AUml5NqFL8eGc5J3hEHdG482ywyT6Ic5U0...
GHSA-28QQ-5F47-R5X2
creationtimestamp| type| source ---|---|--- 2026-01-30 19:05:02+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/115985606322071908...
Allocation of Resources Without Limits or Throttling
Overview io.undertow:undertow-core is a Java web server based on non-blocking IO. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the getParameterNames function. An attacker can cause an OutOfMemoryError by sending requests with...
TikTok’s privacy update mentions immigration status. Here’s why.
In 2026, could any five words be more chilling than “We’re changing our privacy terms?” The timing could not have been worse for TikTok US when it sent millions of US users a mandatory privacy pop-up on January 22. The message forced users to accept updated terms if they wanted to keep using the...
CERTFR-2026-ALE-001
creationtimestamp| type| source ---|---|--- 2026-01-30 11:02:01+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115983706971608725...
UBUNTU-CVE-2026-25061
tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame elements and performs a length check on the wrong field when handling the TIM element. A crafted frame with a large TIM length can cause a 1-byte out-of-bounds write past...
GHSA-M3H4-65J5-6J8C
creationtimestamp| type| source ---|---|--- 2026-01-29 20:49:13+00:00| seen| https://infosec.exchange/users/DarkWebInformer/statuses/115980353620259404...
CVE-2026-1637
creationtimestamp| type| source ---|---|--- 2026-01-29 19:41:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115980086235727489 2026-01-30 02:05:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdm7ny4xlv2t...
CVE-2026-1060
The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permissioncallback set to returntrue, allowing unauthenticated attacke...
CVE-2026-1587
creationtimestamp| type| source ---|---|--- 2026-01-29 13:24:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdkv5wt47d2i...
CGA-RCF5-3QPM-CV2G
Bulletin has no description...
CGA-FCC7-53QC-H47R
Bulletin has no description...
CGA-X8FG-5Q2F-79V7
Bulletin has no description...
CGA-VJM9-PX57-R6M8
Bulletin has no description...
CGA-H4WC-QRJP-C5QP
Bulletin has no description...