16533 matches found
CVE-2026-44187
The CVE-2026-44187 vulnerability affects the Ansible Lightspeed extension for Visual Studio Code. It allows a local attacker or malware operating with the user’s privileges to read the Google Gemini API key because the extension stores the credential in plaintext in the user’s configuration file ...
EUVD-2025-210494
The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...
CVE-2025-13146
The CVE-2025-13146 entry affects the WordPress plugin “Contact Form 7 – Dynamic Text Extension.” The vulnerability allows unauthenticated attackers to execute arbitrary shortcodes by exploiting improper validation before do_shortcode, impacting all versions up to 5.0.6. A partial fix was introduc...
CVE-2025-13146 Contact Form 7 – Dynamic Text Extension <= 5.0.6 - Unauthenticated Arbitrary Shortcode Execution
The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...
CVE-2025-13146 Contact Form 7 – Dynamic Text Extension <= 5.0.6 - Unauthenticated Arbitrary Shortcode Execution
The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
EUVD-2026-47563
Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...
PT-2026-63362
A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...
PT-2026-63336
The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. Thi...
PT-2026-63413
Name of the Vulnerable Software and Affected Versions BIND 9 versions 9.18.0 through 9.18.50 BIND 9 versions 9.20.0 through 9.20.24 BIND 9 versions 9.21.0 through 9.21.23 BIND 9 versions 9.18.11-S1 through 9.18.50-S1 BIND 9 versions 9.20.9-S1 through 9.20.24-S1 Description An issue occurs when th...
CVE-2026-65319
Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...
CVE-2026-65319
Feedbin contains an unauthenticated information disclosure via the GET /api/v2/entries/:id/text endpoint. The vulnerability arises because the authorization check is bypassed (before-action filter skipped), enabling an attacker to enumerate private article content by iterating sequential entry ID...
CVE-2026-65319 Feedbin Unauthenticated Entry Content Disclosure via GET /api/v2/entries/:id/text
Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...
CVE-2026-65319
Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
CVE-2026-56852 Infinite loop on invalid input in golang.org/x/text
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
CVE-2026-56852 Infinite loop on invalid input in golang.org/x/text
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...
CVE-2026-56852
Technical details about CVE-2026-56852 are not publicly provided in the supplied documents; no specifics on affected products, versions, or fixes are present. Monitor for updates from official advisories.
CVE-2026-64823
CVE-2026-64823 affects Home Assistant Core prior to 2026.5.4 via the Shelly integration’s async_get_media_image(), where a data: URI with text/html can bypass the image-only allowlist. The vulnerability enables an attacker controlling a Shelly device’s thumb field to cause the media proxy endpoin...