3913 matches found
AZL-75032 CVE-2026-0865 affecting package python3 for versions less than 3.12.9-8
User-controlled header names and values containing newlines can allow injecting HTTP headers...
PT-2026-43735
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak occurs in the pcs add gpio func function. The of parse phandle with args function returns a device node pointer with an incremented reference count in gpiospec.np...
OSV-2026-76 Security exception in org.htmlunit.cyberneko.HTMLTagBalancer.endElement
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=476170180 Crash type: Security exception Crash state: org.htmlunit.cyberneko.HTMLTagBalancer.endElement org.htmlunit.cyberneko.HTMLElements$HTMLElementsWithCache.getElement...
CVE-2025-10484: Authentication Bypass Using an Alternate Path or Channel
The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.3.1. This is due to the plugin not properly verifying a users identity prior to authenticating them via the fmalwpsetsessionphpfun...
MiracleLinux 7 : 389-ds-base-1.3.6.1-19.el7 (AXSA:2017-2225:06)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2225:06 advisory. A flaw was found in the way 389-ds-base handled authentication attempts against locked accounts. A remote attacker could potentially use this flaw to continu...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000947)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000947 advisory. The mountpointlast function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount...
PT-2026-3021
Name of the Vulnerable Software and Affected Versions Omnispace Agora Project versions prior to 25.10 Description A directory traversal issue exists in Omnispace Agora Project. This allows unauthenticated attackers to read files on the system through the misc controller and the ExternalGetFile...
CVE-2025-67076
Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read files on the system via the misc controller and the ExternalGetFile action. Only files with an extension can be read...
CVE-2025-14846: Cross-Site Request Forgery (CSRF)
The SocialChamp with WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.5. This is due to missing nonce validation on the wpscsettingstabmenu function. This makes it possible for unauthenticated attackers to modify plugin settings...
GHSA-36H5-VRQ6-PP34 Jervis's Salt for PBKDF2 derived from password
Vulnerability https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovyL869-L870...
6 Best Enterprise Security Platforms for 2026
If your security stack feels like a cluttered garage full of single-purpose tools, you’re not alone. You have one tool for endpoints, another for the network, and a few more for the cloud—none of which communicate effectively. This patchwork approach creates dangerous blind spots and buries your...
CVE-2026-0684: Incorrect Authorization
The CP Image Store with Slideshow plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9 due to a logic error in the 'cpisadmininit' function's permission check. This makes it possible for authenticated attackers, with Contributor-level access and...
CVE-2025-55462
A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticat...
CVE-2025-27002
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup CountDown With Image or Video Background countdown-with-background allows Reflected XSS.This issue affects CountDown With Image or Video Background: from n/a through = 1.5...
CVE-2025-62487
On October 1, 2025, Palantir discovered that images uploaded through the Dossier front-end app were not being marked correctly with the proper security levels. The regression was traced back to a change in May 2025, which was meant to allow file uploads to be shared among different artifacts e.g...
CVE-2025-66744
In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, allowing unauthorized access to sensitive information within the system...
CVE-2018-10081
CMS Made Simple CMSMS through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring...
CVE-2021-31899
In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode...