42694 matches found
PT-2026-63840
Unauthenticated Cross Site Request Forgery CSRF in ApusListing = 1.2.63 versions...
PT-2026-63833
Unauthenticated Cross Site Scripting XSS in Smart Manager = 8.90.0 versions...
PT-2026-63891
Unauthenticated Broken Access Control in AWP Classifieds = 4.4.7 versions...
PT-2026-63586
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...
PT-2026-63858
Unauthenticated Broken Authentication in Ziina = 1.2.21 versions...
PT-2026-63805
Contributor SQL Injection in eRoom = 1.7.1 versions...
RockyLinux 8 : .NET 8.0 (RLSA-2026:41901)
The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41901 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...
PT-2026-63945
Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...
CVE-2026-65754: Improper Limitation of a Pathname to a Restricted Directory
Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...
CVE-2026-65537: Missing Authorization
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names = 1.3.3 versions...
CVE-2026-64785: Inconsistent Interpretation of HTTP Requests
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2...
PT-2026-63940
Unauthenticated Broken Access Control in Graphina = 3.1.12 versions...
PT-2026-63828
Unauthenticated Cross Site Scripting XSS in Sprout Clients = 3.2.3 versions...
PT-2026-63855
Unauthenticated PHP Object Injection in Thrive Quiz Builder = 10.9.3.0 versions...
PT-2026-63878
Administrator Arbitrary File Upload in MapSVG = 8.14.0 versions...
PT-2026-63944
Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...
PT-2026-63937
Name of the Vulnerable Software and Affected Versions Visualizer versions prior to 4.0.7 Description Themeisle Visualizer contains an issue involving improper neutralization of special elements used in an SQL command, which allows for Blind SQL Injection. This occurs specifically through the...
PT-2026-63847
Subscriber Broken Access Control in WP ERP = 1.17.5 versions...
PT-2026-64146
Name of the Vulnerable Software and Affected Versions aws-smithy-http-server versions prior to 0.66.5 Description An issue in the default serve path of Amazon aws-smithy-http-server allows unauthenticated Slowloris denial of service. This occurs due to missing connection and header-read timeouts...
