608958 matches found
CVE-2026-18664
NSD (a DNS server maintained by NLnet Labs) contains a flaw in its ACL range comparison logic. On little-endian systems , IP addresses are compared using the host's native endianness instead of network byte order (big-endian) , which is the correct format for the stored values. This affects both ...
CVE-2026-18664
When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...
CVE-2026-80234 CAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication
CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure...
CVE-2026-80234
CAYIN CMS-WS and CMS-SE , developed by CAYIN Technology, are affected by a Missing Authentication vulnerability. An unauthenticated remote attacker can leverage a specific functionality to obtain media file lists , resulting in partial information disclosure . The CNA TW CERT assigned a CVSS 3.1 ...
CVE-2026-78237
Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended...
CVE-2026-9668 SQL injection vulnerability in ZTE SCP product
With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitati...
WordPress Mang Board WP plugin <= 2.3.7 - Authenticated (Subscriber+) Privilege Escalation to Forged Authentication Cookie vulnerability
Authenticated Subscriber+ Privilege Escalation to Forged Authentication Cookie vulnerability discovered by daroo in WordPress Plugin Mang Board WP versions = 2.3.7...
CVE-2026-75977
Mang Board WP WordPress plugin (all versions ≤ 2.3.7 ) suffers from a Missing Authorization vulnerability via authentication cookie forgery. The root cause is flawed HMAC generation in mbw_get_hash_key(), which uses the current user's identity instead of the cookie's username parameter when a Wor...
CVE-2026-6178
The Betheme WordPress theme (all versions up to and including 28.4 ) is vulnerable to stored cross-site scripting via the 'icon_box_2' shortcode. The root cause is insufficient input sanitization and output escaping on user-supplied attributes, allowing any authenticated user with contributor-lev...
CVE-2026-6178 Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode
The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's 'iconbox2' shortcode in all versions up to, and including, 28.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...
CVE-2024-20767-Adobe-ColdFusion
CVE-2024-20767-Adobe-ColdFusion Adobe ColdFusion è una piattaforma di sviluppo rapido per creare e distribuire applicazioni web e mobili. CVE-2024-20767 - Le versioni di ColdFusion 2023.6, 2021.12 e precedenti sono affette da una vulnerabilità di Controllo Accesso Inadeguato che potrebbe portare...
Security Bulletin: Multiple Vulnerabilities in IBM® Runtime Environment Java™ Technology Edition affects WebSphere eXtreme Scale
Summary There are multiple vulnerabilities in IBM Runtime Environment Java Version 8 used by WebSphere eXtreme Scale. Vulnerability Details CVEID:CVE-2026-41254 DESCRIPTION: Little CMS lcms2 through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after...
WordPress WP Data Access plugin <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access vulnerability
Unauthenticated Insecure Direct Object Reference to Data Access vulnerability discovered by type5afe in WordPress Plugin WP Data Access versions = 5.5.68...
WordPress Greenshift plugin <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via Data URI vulnerability discovered by WordFence in WordPress Plugin Greenshift versions = 12.8.9...
CVE-2026-78237 Insufficient input validation in Admin By Request (ABR)
Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended...
CVE-2026-3002
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-58108
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...
bank-api-remediated
vulnbank-api — Remediated Fixed version of bank-api, built...
EUVD-2026-66297
The personal access token removal query selects from PersonalAccessTokenDB but filters on columns of Session, with no join between them. SQLAlchemy resolves that as an implicit cross join, so the filter does not constrain the delete to the calling user's own token in the way the code reads as...