6866 matches found
EulerOS 2.0 SP13 : libsoup (EulerOS-SA-2026-3027)
According to the versions of the libsoup packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the soupbodyinputstreamreadchunked functio...
CVE-2026-70439
Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...
CVE-2026-70439
Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...
CVE-2026-70439
The Jenkins XML Job to Job DSL Plugin version 0.1.13 and earlier is vulnerable to a missing permission check. Attackers lacking appropriate permissions can invoke the plugin's conversion functionality. Specifically, while users can only access jobs for which they have Item/Read permission, the pl...
CVE-2026-71270 Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...
CVE-2026-71270 Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess
Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf...
Missing permission checks in xml-job-to-job-dsl
xml-job-to-job-dsl 0.1.13 and earlier does not perform permission checks, and makes its functionality available to users lacking Overall/Read permission. While only jobs the user has Item/Read permission for will be accessible, it does not require Item/Extended Read permission to convert their...
Google Chrome Microsoft Edge DoS
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type conversion errors. Exploiting this vulnerability can allow a malicious actor to cause service failures...
PT-2026-68274
Name of the Vulnerable Software and Affected Versions Jenkins XML Job to Job DSL Plugin versions prior to 0.1.14 Description The plugin fails to perform necessary permission checks, which allows users without the required privileges to trigger the conversion functionality. Recommendations Update...
CVE-2026-70439: Missing Authorization
Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality...
Malicious code in qlik-object-conversion (npm)
npm/qlik-object-conversion is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11984 Malicious code in qlik-object-conversion (npm)
npm/qlik-object-conversion is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Important: freerdp
Issue Overview: Heap-buffer-overflow write in AVC444 YUV buffer allocation In libfreerdp/codec/h264.c, avc444ensurebuffer computes the AVC444 YUV444 intermediate buffer size as piDstSizex = piDstStridex padDstHeight using UINT32 arithmetic. When the true product exceeds UINT32MAX, the value wraps...
Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2012)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2012 advisory. Heap-buffer-overflow write in AVC444 YUV buffer allocation In libfreerdp/codec/h264.c, avc444ensurebuffer computes the AVC444 YUV444 intermediate buffer size as piDstSizex = piDstStridex...
JLSEC-2026-1160 GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability...
GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convertfname function within src/url.c that allows remote attackers to trigger memory corruption through a server-supplied filename requiring character set conversion. When the output buffer is...
CVE-2026-18573
A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper...
CVE-2026-14315
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's...
CVE-2026-14315
The Pixel Tag Manager for WooCommerce WordPress plugin, in versions before 2.2.1 , contains an authorization bypass vulnerability. The plugin fails to perform an authorization check on one of its AJAX actions , which allows unauthenticated users to submit forged e-commerce conversion events. Atta...
WordPress Pixel Tag Manager for WooCommerce plugin < 2.2.1 - Unauthenticated Forged Conversion Event Submission vulnerability
Unauthenticated Forged Conversion Event Submission vulnerability discovered by Pedro Pinho in WordPress Plugin Pixel Tag Manager for WooCommerce versions 2.2.1...
CVE-2026-14315: Improper Access Control
The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's...