13603 matches found
SUSE CVE-2026-90081
In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...
EulerOS Virtualization 2.12.1 : ca-certificates (EulerOS-SA-2026-3578)
According to the versions of the ca-certificates package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying...
CVE-2026-92554: Improper Neutralization of Input During Web Page Generation
The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-16777: Improper Limitation of a Pathname to a Restricted Directory
The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...
CVE-2026-84738: Improper Control of Generation of Code
The AF Companion WordPress plugin before 2.2.0 does not validate the type of files uploaded through one of its import features, allowing users with a low-privileged store-management role to upload arbitrary files, including PHP ones, leading to Remote Code Execution...
PT-2026-95287
Name of the Vulnerable Software and Affected Versions WP Multi Store Locator Pro versions prior to 4.5.2 Description An issue exists where unauthenticated attackers can perform SQL Injection by appending additional queries to existing ones to extract sensitive database information. This occurs...
CVE-2026-93659: Improper Neutralization of Input During Web Page Generation
Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...
CVE-2026-15275: Improper Neutralization of Special Elements used in an SQL Command
The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'storelocatoresearchradius' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
EulerOS 2.0 SP10 : ca-certificates (EulerOS-SA-2026-3731)
According to the versions of the ca-certificates package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity o...
EulerOS Virtualization 2.11.1 : ca-certificates (EulerOS-SA-2026-3406)
According to the versions of the ca-certificates package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying...
PT-2026-95288
Name of the Vulnerable Software and Affected Versions The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers versions prior to 2.8.1 Description A Directory Traversal issue exists where authenticated attackers with shop manager-level access or higher can read arbitrary...
PT-2026-95428
Name of the Vulnerable Software and Affected Versions Concrete CMS Community Store versions prior to 2.7.8 Description The software fails to perform HTML escaping on customer-supplied order fields within checkout and admin views. This allows unauthenticated attackers to store malicious script...
WordPress Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion vulnerability
Authenticated Shop Manager+ Path Traversal to Arbitrary File Read and Arbitrary File Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Store Exporter versions = 2.8.0...
GHSA-VRF4-MX87-P53W libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses
Summary @libp2p/peer-store accepts a signed PeerRecord whose envelope is signed by one peer but whose payload claims a different peer ID. The vulnerable consumePeerRecord path verifies the envelope signature, but does not verify that the envelope signer is the same peer as the wrapped...
User Impersonation
Overview @libp2p/peer-store is a Stores information about peers libp2p knows on the network Affected versions of this package are vulnerable to User Impersonation via consumePeerRecord in peer-store/src/index.ts, where the peer ID derived from the envelope's signing public key is compared against...
CVE-2026-90081
In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...
CVE-2026-86039
libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does not require PeerRecord.peerId in the signed payload to equal the signer peer ...
CVE-2026-92487
CVE-2026-92487 is a race condition in the Linux kernel's exfat filesystem . When a shared writable mapping has its valid_size extended (via a buffered write or page fault), exfat zeroes the page-cache gap below the new valid_size. A concurrent store through the mapping can race with this zeroing ...
CVE-2026-90081 net/rds: use wq_has_sleeper() in rds_cong_map_updated()
In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...
EUVD-2026-81942
In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...