387916 matches found
CVE-2026-94568: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0...
CVE-2026-107889: Improper Neutralization of Input During Web Page Generation
A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript executio...
CVE-2026-101028: Incorrect Authorization
Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2, Ash.exists/2 and Ash.aggregate/3. Ash.Actions.Aggregate.run/4 lib/ash/actions/aggregate.ex applied only the root resource's read policy before running the...
CVE-2026-107851: Use of Cache Containing Sensitive Information
Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule in core-bundle/src/Security/Voter/DataContainer/TableAccessVoter.php caches authorization decisions using only $tokenHash, a hash of the user's security token, and omits the table returned by...
PT-2026-108769
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf component where an LWT SEG6LOCAL program can invalidate its cached Segment Routing Header SRH using the bpf lwt seg6 adjust srh function and subsequently call...
openSUSE 16 Security Update : alloy (openSUSE-SU-2026:22032-1)
The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22032-1 advisory. - CVE-2026-2303: go.mongodb.org/mongo-driver: mongo-go-driver has Heap Out-of-Bounds Read in GSSAPI Error Handling bsc1269861. - CVE-2026-37236:...
CVE-2026-104392: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...
CVE-2026-103220: Improper Validation of Array Index
The Affinity by Canva application before 3.3.1 October 2026 release did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document tha...
PT-2026-109206
Improper handling of highly compressed data data amplification vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
PT-2026-108912
The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it...
PT-2026-108870
Name of the Vulnerable Software and Affected Versions GDPR Data Request Form versions prior to 1.7.2 Description The plugin lacks Cross-Site Request Forgery CSRF protection—a type of attack that forces an authenticated user to execute unwanted actions—when updating specific settings. This allows ...
PT-2026-108914
Name of the Vulnerable Software and Affected Versions Neo | Barber Shop WordPress Theme versions prior to 3.6 Description An issue in the neocut component allows Object Injection due to the deserialization of untrusted data. Object Injection occurs when an application deserializes untrusted data,...
CVE-2026-86851: Missing Authorization
The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and...
ROS-20261009-73-0413
The vulnerability of the hfsplus component in the Linux operating system’s kernel is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure...
ROS-20261009-73-0281
The vulnerability of the tegrachanneltryformat function in the drivers/staging/media/tegra-video/vi.c file of the Linux kernel’s media data preparation driver is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a system failure...
PT-2026-108907
The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system...
CVE-2026-62036: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31...
MAL-2026-17723 Malicious code in @galicia-toolkit-nestjs/paas (npm)
@galicia-toolkit-nestjs/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim...
Aiohttp HTTP Client Unauthorized Access
The vulnerability of the Aiohttp HTTP client is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
PT-2026-108909
ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the GET /api/1.0/tasks endpoint in ProcessMaker is vulnerable to SQL injection through the order by parameter because ProcessMakerTraitsTaskControllerIndexMethods::applyColumnOrdering concatenates a...