59533 matches found
CVE-2026-18358 Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...
CVE-2026-17567
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...
CVE-2026-18437
The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the mailerpress/v1/contact endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to...
CVE-2026-11770
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...
UBUNTU-CVE-2026-15722
A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...
EUVD-2026-51517
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...
CVE-2026-17567 Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...
CVE-2026-17567
The CVE-2026-17567 entry affects the WordPress plugin Fluent Forms
CVE-2026-11770
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...
CVE-2026-11770
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...
CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...
CVE-2026-11770
The CVE affects 389 Directory Server (389-ds-base) with a pre-auth LDAP filter injection in the CleanAllRUV replication status-check extended operation. An unauthenticated attacker can inject LDAP search filters, causing the handler to search cn=config with elevated replication plugin privileges ...
CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check
A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...
CVE-2026-15722
A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...
CVE-2026-65311
The HTTP server component of ANDRITZ HIPASE-250 formerly 250 SCALA in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit...
Improper Authentication
pytonapi is vulnerable to Improper Authentication. The vulnerability is due to TonapiWebhookDispatcher failing to validate the Authorization header for webhook handlers registered with a custom path, because bearer tokens are only mapped to the default webhook paths, which allows an unauthenticat...
EUVD-2026-51507
The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint POST /wp-json/mailpress/v1/campaign//restore-revision/. The route in the vulnerable range was registered without a permissionCallback,...
CVE-2026-18437
The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the mailerpress/v1/contact endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to...
CVE-2026-18436
The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint POST /wp-json/mailpress/v1/campaign//restore-revision/. The route in the vulnerable range was registered without a permissionCallback,...
CVE-2026-18436
MailerPress for WordPress <= 1.5.0 exposes a missing authorization check on the campaign revision-restore REST endpoint (POST /wp-json/mailpress/v1/campaign//restore-revision/). The vulnerable route allowed the restoreRevision() handler to run for unauthenticated users, enabling modification o...