62220 matches found
WordPress Podlove Podcast Publisher plugin < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion vulnerability
Podcast Contributor/Group/Role Creation and Deletion vulnerability discovered by Ryan Fabella in WordPress Plugin Podlove Podcast Publisher versions 4.5.3...
CVE-2026-13729 Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF
The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request CSRF when a logged-in administrator is tricked into...
CVE-2026-51240
creationtimestamp| type| source ---|---|--- 2026-08-01 03:48:20+00:00| seen| https://gist.github.com/programmervuln/31acdecc004522f8b490f80cfbcde694...
CVE-2026-58181
creationtimestamp| type| source ---|---|--- 2026-08-01 03:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mryk4ibonf2r...
CVE-2026-58177
creationtimestamp| type| source ---|---|--- 2026-08-01 03:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mryigttluu2r...
CVE-2026-51281
creationtimestamp| type| source ---|---|--- 2026-08-01 02:53:58+00:00| seen| https://gist.github.com/programmervuln/4a4670ae02340631b9a5e3eaddece53a...
CVE-2026-51279
creationtimestamp| type| source ---|---|--- 2026-08-01 01:59:08+00:00| seen| https://gist.github.com/programmervuln/d92bcb073a602a09ae408cd64fb249c5...
SUSE CVE-2026-16531
An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...
PT-2026-67223
Name of the Vulnerable Software and Affected Versions ueberauth guardian versions 2.0.0 through 2.4.0 Description An allocation of resources without limits or throttling allows a denial of service via unbounded atom creation from attacker-controlled binary input. The...
CVE-2026-15988: Cross-Site Request Forgery (CSRF)
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.6.5 This is due to missing or incorrect nonce validation on the reauthforauthorize function. This makes it possible for...
CVE-2026-14561: Improper Authentication
The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered...
PT-2026-67221
Name of the Vulnerable Software and Affected Versions ueberauth guardian versions 0.1.0 through 2.4.0 Description An allocation of resources without limits or throttling allows a denial of service via unbounded atom creation from attacker-influenced binary input. The Guardian.Plug.Keys module...
CVE-2026-56066
creationtimestamp| type| source ---|---|--- 2026-07-31 21:44:39+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mrxwfbprgd26...
GHSA-QJ55-47FP-P62J
creationtimestamp| type| source ---|---|--- 2026-07-31 21:31:45+00:00| seen| https://gist.github.com/alon710/0f09a6f6c7f9c253322faa348755ead8...
CVE-2026-62999
creationtimestamp| type| source ---|---|--- 2026-07-31 21:00:19+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrxtwxnwbd2l 2026-08-01 00:15:22+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-62999...
CVE-2026-35847
creationtimestamp| type| source ---|---|--- 2026-07-31 19:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrxnh4gb4m2a...
kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns
A flaw was found in the Linux kernel's rtnetlink component. An unprivileged local user, leveraging a user namespace, can exploit a missing CAPNETADMIN capability check in the rtnlnewlink function. This allows the user to create paired network devices in arbitrary network namespaces, including the...
Important: Red Hat Security Advisory: abrt security update
An update for abrt is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability...
GHSA-R2V3-8GWF-7GHM vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API
Summary The vault-secrets-webhook reads the vault.security.banzaicloud.io/vault-addr annotation from any ConfigMap or Secret being admitted and uses it as the Vault server address without any validation or allowlist. When a ConfigMap or Secret contains a value prefixed with vault:, the webhook's...