401316 matches found
PT-2026-122074
Name of the Vulnerable Software and Affected Versions Holistic Center versions prior to 1.2.7 Description The Holistic Center theme for WordPress is subject to PHP Object Injection due to the deserialization of untrusted data. This allows unauthenticated attackers to inject a PHP Object. While no...
PT-2026-120584
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups, tags and tickets, then log in with seeded accounts using th...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel versions prior to 6.1.178 and prior to 6.6.145. This vulnerability stems from the Bluetooth ISO failing to verify whether a service UUID is the Basic Audio Announcement Service UUID; as a result, Periodic Advertisement Report data may be incorrectly...
Data field - Moderately critical - Cross site scripting - SA-CONTRIB-2026-250
Data Field allows you to create custom fields with multiple values under the default table form. The fileuri formatter does not properly escape filenames when rendering links to uploaded files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to...
CVE-2021-48019: Buffer Access with Incorrect Length Value
Vyper before 0.2.9 deploys forwarder proxies through the built-in createforwarderto function that report a fixed 4096-byte RETURNDATASIZE rather than the actual return data size. Calls through these proxies can yield corrupted data when a function returns more than 4096 bytes without return data...
Apache AsterixDB 0.9.9 Missing Authentication
Apache AsterixDB version 0.9.9 contains a missing authentication vulnerability in its Cluster Controller HTTP API, allowing unauthenticated SQL++ queries and cluster shutdown requests. !/usr/bin/env perl Apache AsterixDB 0.9.9 Missing Authentication Vendor: The Apache Software Foundation Product...
PT-2026-120561
A data race in the RDMA transport of Apache bRPC versions 1.18.0 allows a remote client to crash the server process denial of service when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA with a client, the handshake completes on the TCP fd, but the server...
PT-2026-120460
The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as...
Google Chrome Microsoft Edge Data Compromise
The vulnerability in the FileSystem component of Google Chrome and Microsoft Edge web browsers is related to authorization errors. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...
Google Chrome Microsoft Edge Data Compromise
The vulnerability in Google’s Google Lens component for Google Chrome and Microsoft Edge involves the user interface’s false representation of critical information. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected data by using a specially...
Google Chrome Microsoft Edge DoS
The vulnerability in the Extensions component of Google Chrome and Microsoft Edge is related to reliance on untrusted input during security decision-making. Exploitation of this vulnerability enables a remote attacker to cause a denial of service by sending a specially crafted HTML page...
Google Chrome ServiceWorker Data Compromise
The vulnerability in the ServiceWorker interface of Google Chrome and Microsoft Edge is related to access control flaws. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...
Device component Data Compromise
The vulnerability in the Device component of Google Chrome and Microsoft Edge web browsers is related to improper authorization. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...
Google Chrome Microsoft Edge Data Compromise
The vulnerability in the Bluetooth components of Google Chrome and Microsoft Edge is related to access control flaws. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...
WebXR Interface Compromise Protected Information
The WebXR interface vulnerability in Google Chrome and Microsoft Edge is related to a flaw in the data source validation mechanism. Exploitation of this vulnerability enables a remote attacker to compromise the integrity of protected information by using a specially crafted HTML page...
ALSA-2026:86971 Moderate: cockpit-machines security update
Cockpit component for managing libvirt virtual machines. Security Fixes: cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments CVE-2026-92768 cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list...
Apache AsterixDB 0.9.9 Missing Authentication
Summary Apache AsterixDB is a highly scalable data management system that can store, index, and manage semi-structured data, e.g., much like MongoDB, but it also supports a full-power query language with the expressiveness of SQL and more. Unlike analytics engines like Apache Hive or Apache Spark...
PT-2026-120684
Name of the Vulnerable Software and Affected Versions Cisco products affected versions not specified Description An issue exists in the Snort 3 Visual Basic for Applications VBA Decompression Engine. This is caused by improper range checking during the decompression of user-controlled VBA data. A...
Apache bRPC buffer error vulnerability
A security vulnerability exists in Apache bRPC versions prior to 1.18.0. This vulnerability stems from integer underflow and out-of-bounds reads during the parsing of HTTP/2 DATA frames, potentially allowing unauthenticated remote attackers to send malformed DATA frames and induce a...
Jupyter Server authorization issue vulnerability
Versions 2.0.0 through 2.6.0 of Jupyter Server contain an authorization issue vulnerability. This arises because after enabling GatewayClient.url, WebSocketChannelsHandler fails to perform authorization checks on calls to execute on kernels resources via authorizer.isauthorized.... As a result,...