1997 matches found
NPM: hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest
NPM: hono: Lambda@Edge adapter keeps only the last value of a repeated request header, dropping the rest vulnerability discovered by ? in WordPress Npm hono versions 4.12.25...
CVE-2026-40793 WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in Groundhogg 4.4.1 versions...
CVE-2026-5223 affecting package rust for versions less than 1.75.0-30
CVE-2026-5223 affecting package rust for versions less than 1.75.0-30. A patched version of the package is available...
CVE-2026-42012 affecting package gnutls for versions less than 3.8.13-1
CVE-2026-42012 affecting package gnutls for versions less than 3.8.13-1. An upgraded version of the package is available that resolves this issue...
NPM: Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization
NPM: Fabric.js improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization vulnerability discovered by ? in WordPress Npm fabric versions 7.4.0...
NPM: Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step
NPM: Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step vulnerability discovered by ? in WordPress Npm budibase versions 3.39.0...
WordPress Schema & Structured Data for WP & AMP plugin < 1.60 - Unauthenticated Arbitrary Media Upload vulnerability
Unauthenticated Arbitrary Media Upload vulnerability discovered by 0xBassia in WordPress Plugin Schema & Structured Data for WP & AMP versions 1.60...
CVE-2026-20251
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, and Splunk Secure Gateway versions below 3.10.6, 3.9.20, and 3.8.67, a low-privileged user that does not hold the 'admin' or...
CVE-2026-20253 Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Enterprise
In Splunk Enterprise 10.2 versions below 10.2.4 and 10 versions below 10.0.7, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint. The vulnerability exists because the PostgreSQL sidecar service endpoint lacks authentication controls,...
CVE-2026-29167 affecting package httpd for versions less than 2.4.68-1
CVE-2026-29167 affecting package httpd for versions less than 2.4.68-1. A patched version of the package is available...
CVE-2026-27145 affecting package golang for versions less than 1.25.11-1
CVE-2026-27145 affecting package golang for versions less than 1.25.11-1. A patched version of the package is available...
CVE-2026-10721 Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize calls in the in Permission, Cache, and Search components. An unauthenticated attacker may trigger arbitrary PHP object instantiation if a malicious serialized payload has been placed in the database. Thanks XananasX7...
CVE-2026-42790 affecting package erlang for versions less than 26.2.5.21-1
CVE-2026-42790 affecting package erlang for versions less than 26.2.5.21-1. An upgraded version of the package is available that resolves this issue...
CVE-2026-46598 affecting package docker-compose for versions less than 2.27.0-13
CVE-2026-46598 affecting package docker-compose for versions less than 2.27.0-13. A patched version of the package is available...
CVE-2026-25680 affecting package docker-compose for versions less than 2.27.0-13
CVE-2026-25680 affecting package docker-compose for versions less than 2.27.0-13. A patched version of the package is available...
PT-2026-48495
In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.13, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user that does not hold the "admin" or "power" Splunk roles could craft a malicious classic dashboard that...
CVE-2026-8327
Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update without field whitelisting resulting in password change without requiring the current...
CVE-2026-41058
WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite deleteDump parameter does not apply path traversal filtering, allowing unlink of arbitrary files via ../../ sequences in the GET parameter. Commit...
CVE-2026-33814 affecting package ignition-flatcar for versions less than 2.22.0-5
CVE-2026-33814 affecting package ignition-flatcar for versions less than 2.22.0-5. A patched version of the package is available...