169645 matches found
PT-2026-103031
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...
PT-2026-103534
Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description An OS Command Injection flaw exists where an authenticated administrator can upload a configuration package with insufficiently validated contents. Processing a crafted package allows the...
CVE-2026-92867: Out-of-bounds Write
An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution...
PT-2026-103061
An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution...
CVE-2026-11895: Improper Neutralization of Input During Web Page Generation
The HT Mega Addons for Elementor ā Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Data Table 'displayoptions' Setting in all versions up to, and including, 3.1.1 due to insufficient input sanitization and output escaping. This makes it...
PT-2026-103566
Name of the Vulnerable Software and Affected Versions Kiteworks Core affected versions not specified Description An optional, separately licensed repository-connector feature fails to neutralize special characters in a user-supplied path before passing it to an external command. This allows an...
CentOS Linux 7 [TuxCare] Security Update: libsss_idmap / libsss_simpleifp / libsss_simpleifp-devel / etc (CENTOS7:CLSA-2025:1748967240)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1748967240 advisory. - A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper...
AlmaLinux 9.2 [TuxCare] Security Update: bind / bind-chroot / bind-devel / bind-dnssec-doc / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787734642)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787734642 advisory. - BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN...
PT-2026-103549
Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway affected versions not specified Description An authenticated administrator can write a file outside its intended location and cause the application to execute it. This flaw may lead to remote code execution...
AlmaLinux 9.6 [TuxCare] Security Update: mod_dav_svn / python3-subversion / subversion / subversion-devel / etc (ALMALINUX9.6:CLSA-2026:1778495013)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778495013 advisory. - Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated...
CentOS Linux 8.4 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1774259220)
The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1774259220 advisory. - libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request...
PT-2026-103318
šØ CVE-2026-100271 In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects š@cveNotify...
PT-2026-103544
Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description An authenticated administrator can set a configurable security-policy setting to a value exceeding the maximum permitted limit. This allows the associated security control to be rendered...
PT-2026-103578
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated administrator can force the server to send requests to and interact with internal network services that should not be accessible through the...
PT-2026-103065
Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information...
PT-2026-103038
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators...
PT-2026-103049
The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...
PT-2026-103538
Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description A stored cross-site scripting XSS weakness allows an authenticated user to submit content that executes arbitrary JavaScript in the session of another user who views that content. This can be...
PT-2026-103547
Name of the Vulnerable Software and Affected Versions Kiteworks affected versions not specified Description A command injection flaw allows a high-privileged authenticated administrator to execute arbitrary operating-system commands as root on the affected appliance node. Command injection is a...
PT-2026-103079
Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description An arbitrary file read flaw allows authenticated remote attackers to download arbitrary system files from the server. Recommendations At the moment, there is no information about a newe...