4869 matches found
CVE-2026-64572
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...
CVE-2026-11454
The Groundhogg WordPress plugin (versions <= 4.5.2) is affected by an Insecure Direct Object Reference via GET /wp-json/gh/v4/contacts/. The endpoint’s permission callback only checks a role-level view_contacts capability, and read_single() returns full contact records without object-level own...
CVE-2026-71191
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...
UBUNTU-CVE-2026-71191
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...
CVE-2026-16993 DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not protect its shipping-label storage directory with server-independent access control, relying only on an Apache .htaccess file, so on a web server that does not honor .htaccess such as nginx an unauthenticated visitor...
CVE-2026-71191
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...
CVE-2026-71191
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...
EUVD-2026-53049
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz- headers are covered by the SigV4 signature on presigned URL requests. An attacker who obtains a presigned PUT URL can inject an unsigned X-Amz-Copy-Source header, causing Swift to perform a server-side copy...
CVE-2026-52466
Open Library Foundation VuFind v11.0.3 and v4.1 is vulnerable to toInorrect Access Control. The application fails to stop processing an incoming request in VuFind\Controller\AbstractBase::validateAccessPermission after it has found that controller level access permissions do not allow access to t...
CLSA-2026-1785380498 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 6 CVEs. Fixed in 4.3.9.RELEASE-tuxcare.2...
CLSA-2026-1784943220 TuxCare security update for immutable (1 CVE)
TuxCare rebuilt immutable to address 1 CVE. Fixed in 4.1.0-tuxcare.3...
CLSA-2026-1784856386 TuxCare security update for fast-xml-parser (1 CVE)
TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.7-tuxcare.1...
CLSA-2026-1784683091 TuxCare security update for immutable (1 CVE)
TuxCare rebuilt immutable to address 1 CVE. Fixed in 4.3.7-tuxcare.2...
CLSA-2026-1784769546 TuxCare security update for org.springframework (3 CVEs)
TuxCare rebuilt 21 org.springframework packages to address 3 CVEs. Fixed in 4.3.4.RELEASE-tuxcare.1...
CLSA-2026-1784682758 TuxCare security update for lodash.template (1 CVE)
TuxCare rebuilt lodash.template to address 1 CVE. Fixed in 4.4.0-tuxcare.1...
CLSA-2026-1784250515 TuxCare security update for lodash (2 CVEs)
TuxCare rebuilt lodash to address 2 CVEs. Fixed in 4.17.5-tuxcare.1...
CLSA-2026-1784164007 TuxCare security update for django (1 CVE)
TuxCare rebuilt django to address 1 CVE. Fixed in 4.0.post7+tuxcare...
CLSA-2026-1784250520 TuxCare security update for lodash (4 CVEs)
TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.11-tuxcare.1...