147568 matches found
CVE-2026-77348
Wallos , an open-source self-hostable subscription tracker, ships a second unauthenticated logo-image search endpoint—endpoints/payments/search.php—that was missed when the original httpoxy SSRF fix (CVE-2026-33407) hardened endpoints/logos/search.php. Prior to version 5.0.0 , the endpoint passes...
CVE-2026-77348 Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-33407 GHSA-hhjq-82f8-m6rc, "SSRF via HTTP Proxy Environment Variable" hardened endpoints/logos/search.php by disabling cURL proxying CURLOPTPROXY = '' + CURLOPTNOPROXY = ''. However...
CVE-2026-61641 Wallos: OIDC account takeover via email-based account linking without `email_verified` check
Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified...
libreswan: badly formatted X.509 certificate can cause an assertion failure that crashes the daemon process
A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...
librenswan: IKEv2 Denial of Service via malformed fragmentation
A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets fragments containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check assertion failure. A remote, unauthenticated...
CVE-2026-54600
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4 , the endpoints/db/import.php endpoint lacks authentication. The only protective guard is a check on the user-table row count: if the count is zero (as in a fresh or unconfigured install ), an unauthenti...
CVE-2026-54600 Wallos: Unauthenticated database replacement via import endpoint on fresh install
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...
CVE-2026-54600 Wallos: Unauthenticated database replacement via import endpoint on fresh install
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero fresh/unconfigured install, an unauthenticated attacker can replace the entire database. This issue has...
CVE-2026-82229
An unauthenticated Cross Site Scripting (XSS) vulnerability affects the WordPress Social Login and Register plugin in versions 7.8.2 and earlier . The flaw was discovered by Patchstack researcher Ananda Dhakal and carries a CVSS 3.1 score of 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L...
EUVD-2026-68798
Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...
CVE-2026-82229 WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.2 versions...
CVE-2026-82228
SiteGround Security WordPress plugin versions ≤ 1.6.6 are affected by an unauthenticated 2FA Bypass vulnerability, discovered by Ananda Dhakal via Patchstack. The flaw allows a network-based attacker (with high attack complexity, no prior privileges or user interaction) to bypass two-factor authe...
EUVD-2026-68797
Unauthenticated Bypass Vulnerability in SiteGround Security = 1.6.6 versions...
CVE-2026-82228 WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability
Unauthenticated Bypass Vulnerability in SiteGround Security = 1.6.6 versions...
EUVD-2026-68795
Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-82226
This CVE affects the Tickera (Event Ticketing System) WordPress plugin, versions 3.6.0.2 and below . The vulnerability is an unauthenticated PHP Object Injection , rated CVSS 9.8 (Critical) with a network attack vector requiring no privileges or user interaction, and high impact on confidentialit...
CVE-2026-82226 WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Tickera = 3.6.0.2 versions...
CVE-2026-82225 WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in RegistrationMagic = 6.0.9.8 versions...
CVE-2026-82225
RegistrationMagic (Custom Registration Form Builder with Submission Manager) WordPress plugin versions ≤ 6.0.9.8 are affected by an unauthenticated Broken Authentication vulnerability, discovered by Emiliano Carrizo. The CVSS v3.1 score is 7.4 (HIGH) with a network attack vector, high complexity,...