2286 matches found
CVE-2026-15345
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-15345
The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization WordPress plugin is vulnerable to an authorization bypass in all versions up to and including 3.11.5. The flaw arises from improper verification of a user’s authorization, enabling authenticated attackers with subscriber-level a...
EUVD-2025-210632
The Conditional Authentication Adaptive Authentication script does not correctly enforce the completion of all required authentication steps when a specific multi-step pattern involving certain authenticators is configured. This allows an attacker to bypass intermediate authentication challenges ...
Timing Attack
Overview Affected versions of this package are vulnerable to Timing Attack in the pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime functions. An attacker can obtain sensitive information about the outcome of RSA decryption operations by submitting crafted EnvelopedData and analyzing error...
Exploit for Uncontrolled Resource Consumption in Siemens Simatic_S7-1500_Cpu_1518F-4_Pn\/Dp_Mfp_Firmware
CVE-2023-44487-HTTP2-DoS-Rapid-Reset-Exploit Advanced CVE-2023...
GHSA-4JWF-M4WG-8P66 Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
Summary kiota plugin add / kiota plugin generate with -t APIPlugin emits an attacker-controlled statictemplate.file path from the AI-plugin extensions x-ai-adaptive-card, x-ai-capabilities verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest...
Cisco ASA/FTD Persistent Local Code Execution (CVE-2024-20359)
A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plugins and that has been available in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary code wi...
Cisco ASA/FTD WebVPN Double Free (CVE-2018-0101)
A vulnerability in the Secure Sockets Layer SSL VPN functionality of the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal through PluginsGenerationService in the plugin manifest generation code. An attacker can make the generated Copilot or Teams plugin manifest reference files outside the plugin package by supplying an OpenAPI...
CVE-2026-59864
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin...
CVE-2026-59864 Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin...
CVE-2026-59864 Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin...
CVE-2026-59864
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin...
PT-2026-60489
Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5 Description Kiota is an OpenAPI based HTTP Client code generator. The kiota plugin add and kiota plugin generate using the -t APIPlugin flag functions fail to validate paths in static template.file values sourced...
Cisco Adaptive Security Appliance Software, Firepower Threat Defense Software, IOS Software, and IOS XE Software IKEv2 DoS (cisco-sa-multiprod-ikev2-dos-gPctUqv2)
According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability. - A vulnerability in the Internet Key Exchange version 2 IKEv2 protocol processing of Cisco Adaptive Security Appliance ASA Software, Cisco Firepower Threat Defense FTD Software, Cisco IOS Software, and...
Cisco Adaptive Security Appliance Software, Firepower Threat Defense Software, IOS Software, and IOS XE Software IKEv2 DoS (cisco-sa-multiprod-ikev2-dos-gPctUqv2)
According to its self-reported version, Cisco IOS Software is affected by a vulnerability. - A vulnerability in the Internet Key Exchange version 2 IKEv2 protocol processing of Cisco Adaptive Security Appliance ASA Software, Cisco Firepower Threat Defense FTD Software, Cisco IOS Software, and Cis...
Adaptive AI for Detecting Modern DGA Attacks
...
CVE-2026-41514
OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 4.5.0 and prior to version 4.11.0, the RSA-OAEP decryption implementation in the Hisilicon HPRE crypto driver uses...
CVE-2026-41515
OP-TEE (Trusted Execution Environment for Arm Cortex-A TrustZone) has a vulnerability in the RSA-OAEP decryption path within the NXP CAAM crypto driver. From version 3.9.0 up to, but not including, 4.11.0, the driver uses non-constant-time memcmp() for label hash verification, exposing a Manger-s...