198 matches found
infected-drones
Drones Infectados Vectores de ataque, vulnerabilidades y exploits de Drone a Estación de Control en Tierra Las flotas de drones hoy en día son un operador pilotando docenas o cientos de drones desde una única estación en tierra. Esto convierte a la estación de control en tierra en un objetivo...
WordPress Subscriptions for WooCommerce plugin < 2.0.3 - Unauthenticated Subscription Data Disclosure vulnerability
Unauthenticated Subscription Data Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Subscriptions for WooCommerce versions 2.0.3...
CVE-2026-78474
The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 is missing authentication and authorisation checks on its report-printing routine (via the btn_print parameter). This allows unauthenticated users to retrieve WooCommerce order details and customer contact information, target individua...
CVE-2026-87221
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial...
EUVD-2026-79848
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial...
WordPress Online Scheduling and Appointment Booking System plugin <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter vulnerability
Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversationid' Parameter vulnerability discovered by jtb75 - NG20 LLC in WordPress Plugin Bookly versions = 28.1...
PT-2026-92773
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...
PT-2026-92928
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite component: MWA Terminal Server. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Mobil...
SUSE-SU-2026:3998-1 Security update for java-1_8_0-openjdk
This update for java-180-openjdk fixes the following issues: Update to version jdk8u504 icedtea 3.40.1. - CVE-2026-60589: unauthenticated attacker with network access via multiple protocols can gain unauthorized read access to sensitive data bsc1275777. - CVE-2026-61308: unauthenticated attacker...
AZL-99525 CVE-2026-80904 affecting package kernel 6.6.152.1-1
In the Linux kernel, the following vulnerability has been resolved: net/tls: Fail tlsswspliceread after a failed async decrypt When an async decrypt fails, tlsdecryptdone records the error in ctx-asyncwait.err and calls tlserrabort, which stores it in skerr. tlsswrecvmsg and tlsswreadsock each re...
CVE-2025-15481 Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure
The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...
TencentOS Server 2: java-1.8.0-openjdk (TSSA-2026:0938)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0938 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...
CVE-2026-68559 Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronous exporterExcel.canExportuser authorization guard from models/server/ExporterExcel.js without awaiting it. The returned Promise was always...
CVE-2026-76032
Pydio Cells 5.0.0 through 5.0.2 is affected by a missing authorization flaw in the REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go. Unlike the sibling handler for GET /a/share/cell/{Uuid}, which enforces MatchPolicies with ResourcePolicyAction_READ, the link handler calls L...
CVE-2026-50143 Actor MCP path authority injection leaks Apify token
The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor standby URL with the attacker-controlled...
CVE-2026-72913
Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...
CVE-2026-66685
Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...
CVE-2026-66683
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...
