50385 matches found
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor...
WordPress Fluent Support – Helpdesk & Customer Support Ticket System plugin <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Fluent Support versions = 2.3.0...
CVE-2026-60871
creationtimestamp| type| source ---|---|--- 2026-07-23 17:48:31+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-9...
Updated apache packages fix security vulnerabilities
The updated packages fix security vulnerabilities: Apache HTTP Server: modldap per-dir use-after-free. CVE-2026-29167 Apache HTTP Server: modproxyftp XSS. CVE-2026-29170 Apache HTTP Server: modproxyhtml buffer overflow. CVE-2026-34355 Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow...
CVE-2026-44909
Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGSINITIALWINDOWSIZE to 0 or withholding WINDOWUPDATE frames, causing the server to buffer complete response bodies ...
MINI-JGHC-2PC6-XHC5
Bulletin has no description...
CVE-2026-65550
Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...
CVE-2026-65532
Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...
CVE-2026-65538
Author Cross Site Scripting XSS in Machete = 5.2 versions...
CVE-2026-65525
Unauthenticated Broken Access Control in Civi Framework = 2.2.0 versions...
CVE-2026-65490
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embedded Sensitive Data.This issue affects Create: from n/a through 2.6.0...
CVE-2026-65493
Subscriber PHP Object Injection in Dokan Pro = 5.0.2 versions...
CVE-2026-65466
Custom role Server Side Request Forgery SSRF in JetBooking = 4.1.2 versions...
CVE-2026-65462
Administrator SQL Injection in Uncanny Automator = 7.3.2 versions...
CVE-2026-65454
Contributor SQL Injection in Quiz And Survey Master = 11.2.0 versions...
CVE-2026-61948
Unauthenticated SQL Injection in WPDM – Premium Packages = 6.2.0 versions...
CVE-2026-57397
Unauthenticated Cross Site Scripting XSS in Coaching = 3.9.2 versions...
CVE-2026-27392
Contributor Broken Access Control in uListing = 2.2.0 versions...