36790 matches found
WordPress WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin <= 4.3.7 - Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery vulnerability discovered by Wordfence PRISM in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.3.7...
CVE-2026-54478
A flaw was found in Unbound. When Unbound is configured to listen on a proxy-protocol port with DNS cookies enabled, it incorrectly computes the server cookie using the proxy's network address instead of the actual client's address. This vulnerability allows an off-path attacker to harvest a vali...
CVE-2026-15076
A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...
dscanner — Updated!
dScanner 🔍 Automated web reconnaissance tool for security audits Description dScanner consolidates multiple reconnaissance tools into a single command for the initial phase of web pentesting. Use only on authorized systems!!!! 🚀 Installation Required dependencies: curl dnsutils nmap whois httpx...
CVE-2021-32088
An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...
CVE-2021-32088
The Quest KACE Systems Deployment Appliance (SMA) 11.0.273 is vulnerable to a rate-limiting bypass. Specifically, certain API endpoints include a feature designed to mitigate brute-force attacks, but this protection can be circumvented by removing the kboxid cookie . Exploitation details and spec...
CVE-2021-32088
An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...
CVE-2021-32088
An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...
PT-2026-65226
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP implementation where the sctp sf do 5 2 6 stale function fails to properly validate the length of a STALE COOKIE cause within an ERROR chunk when received in...
PT-2026-65310
Name of the Vulnerable Software and Affected Versions Quest KACE Systems Deployment Appliance SMA version 11.0.273 Description Certain API endpoints implement a rate-limiting feature designed to prevent brute-force attacks. This security mechanism can be bypassed by removing the kboxid cookie...
Telerik UI for ASP.NET AJAX < 2026.2.708 Multiple Vulnerabilities
The version of Telerik UI for ASP.NET AJAX installed on the remote Windows host is prior to 2026.2.708. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout...
MiracleLinux 8 : [security - high] nodejs:24 (AXSA:2026-1352:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1352:01 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...
CVE-2021-32088: Session Fixation
An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...
SUSE CVE-2026-54478
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a...
Improper Validation Of Cookie Domain
Guzzle is vulnerable to Improper Validation of Cookie Domain. The vulnerability is due to improper domain matching for cookies scoped to IP addresses or bare-numeric domains, which allows an attacker to perform cross-host cookie disclosure, cookie injection, or session fixation...
undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header
A flaw was found in undici. When undici processes Set-Cookie headers, it incorrectly interprets the SameSite attribute, accepting partial matches instead of exact ones. This allows a malicious server to downgrade a cookie's SameSite policy to a less secure setting, potentially leading to unintend...
CVE-2026-64475
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of what is now vfiopcicoreregisterdevice without introducing an unwind f...
UBUNTU-CVE-2026-64475
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of what is now vfiopcicoreregisterdevice without introducing an unwind f...
EUVD-2026-48819
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of what is now vfiopcicoreregisterdevice without introducing an unwind f...