4735 matches found
CVE-2026-71554
CVE-2026-71554 affects the Python HTTP/2 stack in the h2 package. Versions up to and including 4.4.0 accept header blocks containing more than one Host header and forward all Host headers to the application. When a client downgrades HTTP/2 to HTTP/1.1, this can yield two Host header lines, enabli...
CVE-2026-66690
Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.5 versions...
CVE-2026-28139
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
CVE-2026-65559
The CVE relates to a privilege-escalation issue in the WordPress plugin Order Delivery Date for WooCommerce, affecting versions up to 4.6.0. The vulnerability targets the shop manager role within the plugin’s delivery date functionality. The provided data constrain the impact to a privilege escal...
CVE-2026-65554
The CVE-2026-65554 entry concerns the WordPress AnsPress – Question and Answer plugin version 4.4.4, with a Broken Access Control vulnerability affecting subscribers. The available connected sources confirm the affected software and the underlying issue as access control in the plugin’s subscribe...
EUVD-2026-53955
Unauthenticated Broken Access Control in SureCart = 4.6.2 versions...
CVE-2026-54225
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update t...
Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12
In the Linux kernel, the following vulnerability has been resolved: ipv4: The need to account for “fraggap” on the paged allocation path. In ipAppendData, when the paged-allocation branch is taken, alloclen and pagedlen are calculated as follows: alloclen = fragheaderlen + transhdrlen; pagedlen =...
CVE-2026-64572
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...
UBUNTU-CVE-2026-64572
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...
CVE-2026-64572
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...
CVE-2026-11454
The Groundhogg WordPress plugin (versions <= 4.5.2) is affected by an Insecure Direct Object Reference via GET /wp-json/gh/v4/contacts/. The endpoint’s permission callback only checks a role-level view_contacts capability, and read_single() returns full contact records without object-level own...
CVE-2026-71191
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...
CVE-2026-16993 DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...
CVE-2026-71191
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...
EUVD-2026-53049
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...
CVE-2026-71191
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...
CLSA-2026-1785380498 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 6 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.2...