42748 matches found
CVE-2026-15827 GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints
The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and including, 2.4.12. Both endpoints are...
Extra fix for CVE-2026-40622 to also clamp the TTL of A/AAAA records disallowing a one-time 'ghost domain' delegation renewal via glue records
...
EUVD-2026-47932
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...
CVE-2026-52684
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...
CVE-2026-16287 Root Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0...
CVE-2026-16653 boazsegev facil.io Public Folder http.c http_sendfile2 path traversal
A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function httpsendfile2 of the file lib/facil/http/http.c of the component Public Folder Handler. Performing a manipulation results in path traversal. Remote exploitation of the attack is possible. The exploit...
PT-2026-63868
Unauthenticated Broken Access Control in PayU India = 3.8.9 versions...
PT-2026-63929
Contributor Cross Site Scripting XSS in Appointment Hour Booking = 1.5.86 versions...
PT-2026-63939
Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...
PT-2026-63825
Unauthenticated Cross Site Scripting XSS in Coaching = 3.9.2 versions...
CVE-2026-59542: Improper Limitation of a Pathname to a Restricted Directory
Subscriber Arbitrary File Deletion in Kali Forms = 2.4.18 versions...
PT-2026-63805
Contributor SQL Injection in eRoom = 1.7.1 versions...
PT-2026-63816
Contributor Cross Site Scripting XSS in Hubbub Lite = 1.36.3 versions...
PT-2026-63830
Subscriber Cross Site Scripting XSS in Slider Pro = 4.8.13 versions...
PT-2026-63866
Unauthenticated SQL Injection in TrueBooker = 1.2.3 versions...
PT-2026-63833
Unauthenticated Cross Site Scripting XSS in Smart Manager = 8.90.0 versions...
PT-2026-63586
If the auth responds very slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records are expired, and in that case not use...
PT-2026-63945
Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...