PT-2026-95763

Name of the Vulnerable Software and Affected Versions WPGraphQL Smart Cache versions prior to 2.3.2 Description The plugin fails to require authorization or validate the caller-supplied query identifier when storing a persisted query from a request. This allows unauthenticated users to publish...

CVE-2026-92099: Improper Access Control

The WPGraphQL Smart Cache WordPress plugin before 2.3.2 does not require authorisation or validate a caller-supplied query identifier before storing a persisted query from a request, allowing unauthenticated users to publish arbitrary query documents and claim query aliases before a site's own...

CVE-2026-76579: Improper Neutralization of Input During Web Page Generation

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

Linux Distros Unpatched Vulnerability : CVE-2026-93894

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper and .lower string type methods of VCL. This can be used as a remote...

CVE-2026-93894

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper and .lower string type methods of VCL. This can be used as a remote denial of service DoS vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability...

DEBIAN-CVE-2026-93894

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper and .lower string type methods of VCL. This can be used as a remote denial of service DoS vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability...

UBUNTU-CVE-2026-93894

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper and .lower string type methods of VCL. This can be used as a remote denial of service DoS vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability...

CVE-2026-93894

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper and .lower string type methods of VCL. This can be used as a remote denial of service DoS vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability...

CVE-2026-93894

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper and .lower string type methods of VCL. This can be used as a remote denial of service DoS vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability...

EUVD-2026-83400

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper and .lower string type methods of VCL. This can be used as a remote denial of service DoS vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability...

CVE-2026-93894

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper and .lower string type methods of VCL. This can be used as a remote denial of service DoS vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability...

CVE-2026-93894

Vinyl Cache before 9.0,2 contains a workspace buffer overflow in the .upper() and .lower() string type methods of VCL , allowing a remote denial of service by causing the child process to segfault or assert and restart. Effective exploitation requires prior knowledge of the VCL in use and the abi...

CVE-2026-93894

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper and .lower string type methods of VCL. This can be used as a remote denial of service DoS vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via improper validation of security-zeroed cache entries when processing client max-stale directives. An unauthenticated attacker can request the same URL with a large max-stale value to retrieve cached responses...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the varyMatches function, which fails to properly handle Vary: wildcard headers due to byte-for-byte string comparison. An attacker can request URLs previously fetched by other clients to receive cached...

GHSA-CH52-4W7C-C8XP http-cache-semantics max-stale handling can disclose cross-user cached responses

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

@2109-t5/server (>=1.0.0, <=1.0.9), @accounter/green-invoice-graphql (>=0.7.2-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, <=0.7.3-alpha-20250224164805-3a96c9f8d619656e3b6a8c0d26319b937adbafe6) +264 more potentially affected by CVE-2026-93748 via http-cache-semantics (>=4.0.3, <=4.1.1)

http-cache-semantics NPM version =4.0.3, =1.0.0, =0.7.2-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =0.2.3-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =0.2.3-alpha-20241120214048-10c1c799e5b6e6f25a0ba6b04c8e435c733deff8, =15.0.0, =1.1.3, =1.1.0, =3.0.0,...

http-cache-semantics max-stale handling can disclose cross-user cached responses

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

AZL-103448 CVE-2026-93748 affecting package nodejs-nodemon 2.0.3-5

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...

DEBIAN-CVE-2026-93748

http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to...