357147 matches found
CVE-2026-14279
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...
Exploit for CVE-2026-73633
CVE-2026-73633 Apache Struts S2-072 — PoC + Environment...
CVE-2026-14279
CVE-2026-14279 affects the Wholesale Market plugin for WordPress. Vulnerable through version 2.2.2 via the ced_wholesale_request_send AJAX action. The root cause is flawed access control: the ced_wholesale_request_send_callback() only verifies a nonce and a positive user ID, then calls WP_User::a...
CVE-2026-14279 Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...
CVE-2026-14279
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...
EUVD-2026-59594
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...
CVE-2026-14279 Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the cedwholesalerequestsend AJAX action. The cedwholesalerequestsendcallback handler only verifies a nonce which is exposed to any authenticated user through wplocalizescrip...
CVE-2026-15826 User Profile Builder <= 3.16.4 - Unauthenticated Authentication Bypass via Type Confusion to Administrator Account Takeover via 'username' Parameter
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppbloginuser function calling absint on the return value of wpinsertuser before performing an iswperror check — when a registration...
threatcl v0.6.6
threatcl Threat Modeling with HCL What happened to hcltm? hcltm has been renamed to threatcl. Welcome! Overview !TIP Want to read the new documentation? Head over to threatcl.dev There are many different ways in which a threat model can be documented. From a simple text file, to more in-depth wor...
DEBIAN-CVE-2026-74383
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel...
CVE-2026-74383
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix out-of-bounds access in nvmesetupdescriptorpools nvmesetupdescriptorpools indexes dev-descriptorpools using the numanode forwarded from hctx-numanode by its single caller, nvmeinithctxcommon. On a non-NUMA kernel...
CVE-2026-74320
In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info-ediddata isn't free if the probe functions fail or if pd-defmode ...
DEBIAN-CVE-2026-74320
In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info-ediddata isn't free if the probe functions fail or if pd-defmode ...
CVE-2026-74287
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctpverifyasconf and sctpverifyparam only validate ADDIP, DELIP, and SETPRIMARY parameters against a fixed minimum size of sizeofstruct sctpaddipparam + sizeofstruct sctpparamhdr...
DEBIAN-CVE-2026-74287
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctpverifyasconf and sctpverifyparam only validate ADDIP, DELIP, and SETPRIMARY parameters against a fixed minimum size of sizeofstruct sctpaddipparam + sizeofstruct sctpparamhdr...
DEBIAN-CVE-2026-72488
In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdwaddelementgroupcount found by syzkaller The original implementation caused an out-of-bounds memory access in the sdwaddelementgroupcount for-loop when i == num. for i = 0; i ratesi && lane == group-lanesi...
CVE-2026-72488
In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdwaddelementgroupcount found by syzkaller The original implementation caused an out-of-bounds memory access in the sdwaddelementgroupcount for-loop when i == num. for i = 0; i ratesi && lane == group-lanesi...
CVE-2026-72483
In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function handles USB hub class requests to the virtual root hub. In the default branches of both the ClearPortFeature and SetPortFeature switc...
DEBIAN-CVE-2026-72483
In the Linux kernel, the following vulnerability has been resolved: usb: host: max3421: Fix shift-out-of-bounds in max3421hubcontrol The max3421hubcontrol function handles USB hub class requests to the virtual root hub. In the default branches of both the ClearPortFeature and SetPortFeature switc...
CVE-2026-72471
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent potential lcn remains uninitialized The target VCN being sought was not found within runs0, causing runlookup to return false. This causes runlookupentry to return false, which in turn results in a len value of ...