59261 matches found
CVE-2025-14947 All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxcallbackcreatebunnystreamvideo, ajaxcallbackgetbunnystreamvideo, and ajaxcallbackdeletebunnystreamvideo functions in all versions up to, and including,...
CVE-2025-14947
The CVE-2025-14947 entry concerns the All-in-One Video Gallery WordPress plugin (versions up to 4.6.4). The vulnerability is a missing capability check in ajax_callback_create_bunny_stream_video, ajax_callback_get_bunny_stream_video, and ajax_callback_delete_bunny_stream_video, allowing unauthent...
CVE-2025-14947 All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion
The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxcallbackcreatebunnystreamvideo, ajaxcallbackgetbunnystreamvideo, and ajaxcallbackdeletebunnystreamvideo functions in all versions up to, and including,...
CVE-2026-22978
creationtimestamp| type| source ---|---|--- 2026-01-23 17:18:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md47h24a6q23 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-04-02 17:00:00+00:00| seen|...
CVE-2026-22985
creationtimestamp| type| source ---|---|--- 2026-01-23 17:16:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md47cvqudc26...
CVE-2022-25369
An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue when determining if the setup phases of the product can be run again. Once an attacker is authenticated as the new admin user they have...
CVE-2026-22984
creationtimestamp| type| source ---|---|--- 2026-01-23 17:10:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md46y4gfdw2c 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-04-02 17:00:00+00:00| seen|...
CVE-2026-22986
creationtimestamp| type| source ---|---|--- 2026-01-23 17:08:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md46ux52gp26...
CVE-2026-22995
creationtimestamp| type| source ---|---|--- 2026-01-23 17:00:06+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115945478831888782 2026-01-23 17:24:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3md47qfunwz2h...
CVE-2025-71177 LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search
LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package creation and search functionality. Authenticated users can supply crafted HTML or JavaScript in the package Name or Description fields that is stored and later rendered without prop...
CVE-2025-71177
LavaLite CMS ≤ 10.1.0 is reported to have a stored XSS vulnerability in package creation and package search. Authenticated users can inject HTML/JavaScript into the Package Name or Description fields, which is stored and later rendered without proper output encoding in search results, enabling po...
CVE-2026-22985
In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initialized until the interface comes up, causing the following NULL pointer crash when ethtool operations like rxhash on/off are performed befor...
UBUNTU-CVE-2026-22985
In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initialized until the interface comes up, causing the following NULL pointer crash when ethtool operations like rxhash on/off are performed befor...
UBUNTU-CVE-2026-22988
In the Linux kernel, the following vulnerability has been resolved: arp: do not assume devhardheader does not change skb-head arpcreate is the only devhardheader caller making assumption about skb-head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after...
CVE-2026-22985
In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initialized until the interface comes up, causing the following NULL pointer crash when ethtool operations like rxhash on/off are performed befor...
CVE-2026-22985
CVE-2026-22985 affects the Linux kernel idpf driver. The vulnerability causes a NULL pointer dereference when ethtool operations (e.g., rxhash) are invoked before the interface is up due to the RSS LUT not being initialized. The fix moves RSS LUT initialization from ndo_open to vport creation to ...
CVE-2026-22985
In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initialized until the interface comes up, causing the following NULL pointer crash when ethtool operations like rxhash on/off are performed befor...
CVE-2026-22985 idpf: Fix RSS LUT NULL pointer crash on early ethtool operations
In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethtool operations The RSS LUT is not initialized until the interface comes up, causing the following NULL pointer crash when ethtool operations like rxhash on/off are performed befor...