49293 matches found
CVE-2026-46428
A flaw was found in lettre, a mailer library for Rust. An inverted-boolean bug in the boring-tls integration silently disables TLS hostname verification for users employing the default strict configuration. A remote on-path attacker can exploit this by presenting any valid TLS certificate, allowi...
CVE-2026-16774
The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcssendemail AJAX handler. This is due to the wpcssendemail function being registered on both wpajaxwpcssendemail and wpajaxnoprivwpcssendemail with no nonce verification,...
CVE-2026-15025
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automatorgooglecontactsfetchlabels, automatormauticsegmentfetch, automatormautictagsfetch, and...
BIT-THRIFT-2026-48144 Apache Thrift: c_glib TLS Client Missing Hostname Verification
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
CVE-2026-15014 SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billingphone parameter. This is due to the processRegistration...
EUVD-2026-49666
Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...
PT-2026-65521
Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and...
PT-2026-65403
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 3.9.7 via the billing phone parameter. This is due to the processRegistration...
Linux Distros Unpatched Vulnerability : CVE-2026-55953
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered ...
CVE-2026-61957 WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...
CVE-2026-61957
Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...
EUVD-2026-49595
In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetrickeys - fix OOB read in pefiledigestpecontents pefiledigestpecontents computes the trailing-data hash length as pelen - hashedbytes + certssize. A crafted PE can make the addition exceed pelen, causing the unsign...
EUVD-2026-49406
A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...
OSEC-2026-12 AEAD `decrypt_into` functions writes plaintext before checking the tag
On the generic GCM path, AES.GCM.authenticatedecryptinto as well as Chacha20.authenticatedecryptinto and AES.CCM16.authenticatedecryptinto writes the decrypted plaintext into the caller's destination buffer and only then compares the tag. On a forged tag the function returns false, but the...
CVE-2026-55953
The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...
DEBIAN-CVE-2026-55953
The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...
UBUNTU-CVE-2026-55953
The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...
EUVD-2026-49332
phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding...
CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...
