383472 matches found
Aiohttp HTTP Client Unauthorized Access
The vulnerability of the Aiohttp HTTP client is related to the restoration of unreliable data in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
PT-2026-108870
Name of the Vulnerable Software and Affected Versions GDPR Data Request Form versions prior to 1.7.2 Description The plugin lacks Cross-Site Request Forgery CSRF protection—a type of attack that forces an authenticated user to execute unwanted actions—when updating specific settings. This allows ...
PT-2026-108915
Name of the Vulnerable Software and Affected Versions ColorFolio versions prior to 1.4 Description BuddhaThemes ColorFolio colorit contains a deserialization of untrusted data flaw that allows Object Injection. Object Injection occurs when untrusted data is used to abuse the logic of an applicati...
PT-2026-108914
Name of the Vulnerable Software and Affected Versions Neo | Barber Shop WordPress Theme versions prior to 3.6 Description An issue in the neocut component allows Object Injection due to the deserialization of untrusted data. Object Injection occurs when an application deserializes untrusted data,...
PT-2026-108871
Name of the Vulnerable Software and Affected Versions Livees Checkout WordPress plugin versions prior to 7.0.3 Description The order confirmation page fails to perform capability, nonce, or order-key checks before processing request parameters. This allows unauthenticated users to modify the stat...
PT-2026-108984
Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev101 Description The rpc function in api blueprint.py handles multipart/form-data uploads by reading the entire content of the uploaded file into memory using file.read before sending the data to the underlyi...
MAL-2026-17723 Malicious code in @galicia-toolkit-nestjs/paas (npm)
@galicia-toolkit-nestjs/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim...
PT-2026-108885
Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0...
PT-2026-108954
Name of the Vulnerable Software and Affected Versions SmarterMail versions prior to build 9777 Description A stored mutation cross-site scripting issue exists where remote attackers can inject executable scripts. This occurs by placing payloads inside a element nested within MathML foreign conten...
ROS-20261009-73-0413
The vulnerability of the hfsplus component in the Linux operating system’s kernel is related to data type conversion errors. Exploiting this vulnerability can allow an attacker to cause a service failure...
Linux Distros Unpatched Vulnerability : CVE-2026-44034
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes ...
Aiohttp HTTP client Host Certificate DOSS
The vulnerability of the Aiohttp HTTP client is related to the lack of checking host certificate data. Exploiting this vulnerability can allow a remote attacker to cause service failures...
HAProxy drl field Data Compromise
The vulnerability of the drl field in the fcgiconn structure of the HAProxy server software is related to integer overflow. Exploiting this vulnerability can allow an attacker to compromise the integrity and accessibility of the protected information...
HTTP/3 Server Data Compromise
The vulnerability of HTTP/3 server-side software such as HAProxy is related to errors in processing input data length parameters. Exploiting this vulnerability can allow a malicious actor to compromise the integrity of protected information...
PT-2026-108875
Name of the Vulnerable Software and Affected Versions All Bootstrap Blocks versions prior to 1.3.32 Description An issue in the all-bootstrap-blocks component allows the retrieval of embedded sensitive data, leading to the exposure of sensitive system information to an unauthorized control sphere...
Aiohttp HTTP Client Source Verification Confidential Data Access
The vulnerability of the Aiohttp HTTP client is related to a lack of mechanisms for verifying the source of the connection. Exploiting this vulnerability can allow an attacker operating remotely to gain access to confidential data...
Cisco Application Policy Infrastructure Controller Message Data Compromise
The vulnerability of the Cisco Application Policy Infrastructure Controller APIC management tool is related to insufficient assurance of the correctness of messages or data structures. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and...
Elasticsearch 7.17.5 / 17.17.29 / 8.2.2 < 8.19.19 / 9.x < 9.3.8 / 9.4.x < 9.4.4 Incorrect Authorization (ESA-2026-188)
The version of Elasticsearch installed on the remote host is prior to 8.19.19, 9.3.8, 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-188 advisory. - Incorrect Authorization CWE-863 in Elasticsearch can lead to unauthorized data stream modification via Accessing...
Data Sharing Service Windows Privilege Escalation
The vulnerability of the Data Sharing Service client for the Windows operating system is related to the lack of authentication. Exploiting this vulnerability can allow an attacker to increase their privileges...