177559 matches found
CVE-2026-15136 Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This is due to missing or incorrect nonce validation on the processbulkaction function. This makes it possible for unauthenticated...
CVE-2026-17524
The CVE-2026-17524 entry concerns the zip-lib package for Node.js, with versions before 1.1.0 vulnerable to Directory Traversal during extraction via the caching path-validation logic. The root cause is that the isOutsideTargetFolder check is only performed when the initial directory symlink is c...
CVE-2026-17524
Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...
CVE-2026-17524
Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...
CVE-2026-17524
Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...
EUVD-2026-49687
Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...
EUVD-2026-49632
The vulnerability involves an Insecure Direct Object Reference IDOR in the DeleteNotificationController::delete method at endpoint GET /notification/delete/id. The flaw allows any authenticated user, regardless of company or permissions, to delete notifications belonging to any other user in the...
EUVD-2026-49926
In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow in the ID3v2 APIC frame parsing function in audiolib allows remote attackers to execute arbitrary code or cause a denial of service crash via a crafted MP3 file. The vulnerability exists due to missing length validation when...
PT-2026-65475
Parts of the DM OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized...
Linux Distros Unpatched Vulnerability : CVE-2026-48144
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are...
Pagy I18n locale option is not validated before being used in a file path
Summary Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file .yml. An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params:locale — let that input influence which file Pagy...
Linux Distros Unpatched Vulnerability : CVE-2026-59251
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service b...
PT-2026-65516
Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network...
EUVD-2026-49867
schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the connecttospeech function. The application accepts attacker-controlled long speech text input, performs URL encoding, and directly appends the encoded result into a fixed psptr heap buffer when constructing HTT...
PT-2026-65615
Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.63.0 Description A server-side request forgery SSRF exists due to a time-of-check/time-of-use TOCTOU gap during DNS resolution. The software validates the resolved IP of a fetch target to block...
CVE-2026-51251
CVE-2026-51251 has concrete details in connected sources: ESP32-audioI2S 3.4.5 contains a buffer overflow in the MP3Decoder::decode() function of the MP3 decoder, caused by missing size validation on untrusted mainDataBegin and nSlots values. This vulnerability is specific to that component/versi...
FreeBSD : Erlang/OTP -- denial of service via exponential certificate policy tree growth (445d674f-89e1-11f1-b35c-4c526214c986)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 445d674f-89e1-11f1-b35c-4c526214c986 advisory. https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352 reports: A remote attacker can...
PT-2026-65463
Name of the Vulnerable Software and Affected Versions Apache ActiveMQ AMQP versions prior to 5.19.9 Apache ActiveMQ AMQP versions 6.0.0 through 6.2.7 Apache ActiveMQ versions prior to 5.19.9 Apache ActiveMQ versions 6.0.0 through 6.2.7 Apache ActiveMQ All versions prior to 5.19.9 Apache ActiveMQ...
PT-2026-69162
It was discovered that the rabbitmq-c command-line tools only accepted credentials on the command line, making them visible to other local users through the process list. An attacker could possibly use this to obtain sensitive credentials. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04...