EUVD-2026-64607

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-64603

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...

SUSE CVE-2026-74597

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: clear skb2-cb in ip6ip6err ip6ip6err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6send. The clone still carries the outer packet's inet6skbparm in...

SUSE CVE-2026-74733

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953xirqbussyncunlock regmap lock Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions read or write must hold the i2clock. The function...

PT-2026-79767

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

CVE-2026-78051

alexta69 MeTube (up to 2026.06.10) contains a vulnerability in the Cookie File Handler component that allows remote, unauthenticated access to the file /download/.metube/cookies.txt. This results in information disclosure of stored cookie data, rated CVSS 3.1: 5.3 (MEDIUM) with low confidentialit...

CVE-2026-78051 alexta69 MeTube Cookie File cookies.txt file access

A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories accessible. The attack can be initiated remotely. The explo...

CVE-2026-78051 alexta69 MeTube Cookie File cookies.txt file access

A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories accessible. The attack can be initiated remotely. The explo...

CVE-2026-0551 PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.18 via deserialization of untrusted input from the 'postprotectionroles' vulnerable parameter. This makes it possible for authenticated attackers, with...

WordPress PPWP – Password Protect Pages plugin <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection vulnerability

Authenticated Contributor+ PHP Object Injection vulnerability discovered by Webbernaut in WordPress Plugin PPWP versions = 1.9.18...

CVE-2026-18027

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.9.8 . The flaw resides in the get_image_src_in_base64 function, which processes the customer_note parameter witho...

CVE-2026-78122

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...

CVE-2026-78122

docker-socket-proxy (Tecnativa) through 0.5.0 has an insufficient access control granularity flaw in the /containers Docker API namespace. When the CONTAINERS environment variable is set, read endpoints (/containers/{id}/archive, /export, /logs, /top) are not properly gated, allowing an unauthent...

CVE-2026-78122 docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...

CVE-2026-78122 docker-socket-proxy through 0.5.0 Insufficient Access Control Granularity Exposes Container Filesystems

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/id/archive, /containers/id/export, /containers/id/logs, and /containers/id/top to read arbitrary files a...

CVE-2026-60004-poc-gitea

CVE-2026-60004 Proof-of-Concept PoC Überblick Dieses Repository enthält ein Proof-of-Concept-Tool für CVE-2026-60004, einen authentifizierten oder vorauthentifizierten Remote-Code-Execution-RCE-Vektor, der bestimmte Gitea-Versionen über die diffpatch-Hook-Injection-Technik betrifft. Die primäre...

westone-CVE-2021-45232-scanner

westone-CVE-2021-45232-scanner Apache APISIX Dashboard versioni precedenti 2.10.1 presentano una vulnerabilità di sicurezza relativa all'accesso non autorizzato. La Manager API utilizza due framework e introduce il framework droplet sulla base del framework gin; tutte le API e i middleware di...

CVE-2024-25092

CVE-2024-25092 Exploit Panoramica CVE-2024-25092 è una vulnerabilità ad alta gravità che colpisce il plugin WordPress NextMove Lite versioni = 2.17.0. Questa vulnerabilità consente a un utente con permessi da subscriber o superiori di installare e attivare plugin arbitrari su un sito WordPress a...

Next.Js-middleware-bypass-vulnerability-CVE-2025-29927

Ein grundlegender Proof of Concept der CVE-2025-29927-Schwachstelle, die das Umgehen der Middleware-Skripte ermöglicht. Details: Hier lesen Dies verwendet Next.js Version 15.2.2. Die Schwachstelle ermöglicht es dem Benutzer, das Middleware-Skript zu umgehen, das die Verifizierung enthält, und auf...

SUSE CVE-2026-72815

go-chi chi versions = 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first leftmost value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log...