55283 matches found
EUVD-2026-29419
The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsbhandleslekpaymentredirect function placing the merchant's slekkey and sleksecret API credentials directly into a client-side HTML form, and additionally embedding the...
USN-8268-1 dnsmasq vulnerabilities
Andrew S. Fasano, Royce M, and Hugo Martinez Ray discovered that Dnsmasq did not allocate the necessary space to store domain names in some contexts. An attacker could possibly use this issue to write out-of-bounds, and could cause a denial of service or execute arbitrary code. CVE-2026-2291 Royc...
USN-8268-1: Dnsmasq vulnerabilities
Andrew S. Fasano, Royce M, and Hugo Martinez Ray discovered that Dnsmasq did not allocate the necessary space to store domain names in some contexts. An attacker could possibly use this issue to write out-of-bounds, and could cause a denial of service or execute arbitrary code. CVE-2026-2291 Royc...
CVE-2026-7626
The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsbhandleslekpaymentredirect function placing the merchant's slekkey and sleksecret API credentials directly into a client-side HTML form, and additionally embedding the...
BIT-PGBOUNCER-2026-6667 PgBouncer missing authorization check in KILL_CLIENT admin command
PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILLCLIENT admin command. All users with access to the administration console which itself requires authorization could run this command. It would have been correct to allow only users listed in the adminusers...
CVE-2026-7626
The Slek Gateway for WooCommerce plugin for WordPress is vulnerable to Information Exposure in version 1.0. This is due to the wsbhandleslekpaymentredirect function placing the merchant's slekkey and sleksecret API credentials directly into a client-side HTML form, and additionally embedding the...
CVE-2026-7626
The CVE-2026-7626 entry concerns the WordPress plugin Slek Gateway for WooCommerce (version 1.0) with an Information Exposure vulnerability. The root cause is that the function wsb_handle_slek_payment_redirect() embeds the merchant’s API credentials (sle k_key and slek_secret) directly into a cli...
Malicious code in @draftauth/client (npm)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 5e1924464368f0c5816ee84e000cc47017f44045140feafbbc9e685d847ed5a5 This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor. The package will steal credentials...
MAL-2026-3594 Malicious code in @draftauth/client (npm)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 5e1924464368f0c5816ee84e000cc47017f44045140feafbbc9e685d847ed5a5 This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor. The package will steal credentials...
MAL-2026-3499 Malicious code in @tanstack/vue-start-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b11c2f37aa0a8c4d809c3136f8f7c227c463f4f8e7a2b4515336b730941dcc4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @tanstack/vue-start-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b11c2f37aa0a8c4d809c3136f8f7c227c463f4f8e7a2b4515336b730941dcc4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-3485 Malicious code in @tanstack/solid-start-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4905d7bb1a4d6f69ec73fe4cc8fa958262fcab1397fed5725ac39db447f6239a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @tanstack/solid-start-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4905d7bb1a4d6f69ec73fe4cc8fa958262fcab1397fed5725ac39db447f6239a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @tanstack/start-client-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5561f0a3c6cc70a2aee56f25476fadbba6cc833f55c0dde246737b99f38c9e8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-3487 Malicious code in @tanstack/start-client-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5561f0a3c6cc70a2aee56f25476fadbba6cc833f55c0dde246737b99f38c9e8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2026-40384
Name of the Vulnerable Software and Affected Versions HashiCorp Nomad versions prior to 2.0.1 HashiCorp Nomad Enterprise versions prior to 2.0.1 Description An issue exists that allows arbitrary file read and write operations on the client host with the privileges of the Nomad process user. This ...
PT-2026-40039
Name of the Vulnerable Software and Affected Versions Ivanti Secure Access Client versions prior to 22.8R6 Description A race condition allows a locally authenticated user to escalate privileges to SYSTEM. A race condition is a situation where the system's substantive behavior is dependent on the...
HashiCorp Nomad和HashiCorp Nomad Enterprise 路径遍历漏洞
HashiCorp Nomad and HashiCorp Nomad Enterprise are both products from HashiCorp, a company based in the United States. HashiCorp Nomad is a simple and flexible scheduler and orchestrator. It’s used for managing containers and non-containerized applications on both local and cloud environments...
PT-2026-40386
Name of the Vulnerable Software and Affected Versions HashiCorp Nomad exec2 task driver versions prior to 0.1.2 Description The exec2 task driver allows arbitrary file read and write operations on the client host with the privileges of the Nomad process user. This is possible through a symlink...
Microsoft Windows Cryptographic Services 安全漏洞
Microsoft Windows Cryptographic Services are encryption services provided by Microsoft Corporation. There are security vulnerabilities associated with Microsoft Windows Cryptographic Services. Attackers can exploit these vulnerabilities to gain higher privileges. The following products and versio...