982 matches found
JoomSport <= 5.7.7 - SQL Injection
The JoomSport WordPress plugin through 5.7.7 is vulnerable to unauthenticated time-based blind SQL injection via the 'sortf' GET parameter in the player list view. The parameter value is backtick-wrapped and directly concatenated into an ORDER BY clause. id: CVE-2026-42647 info: name: JoomSport =...
ROOT-OS-UBUNTU-2404-CVE-2025-71192 CVE-2025-71192 in linux - Patched by Root
Root has patched CVE-2025-71192 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
CVE-2026-11920
The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based SQL Injection via the 'order' parameter in all versions up to, and including, 5.7.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
Exploit for CVE-2026-64560
CVE-2026-64560 — Linux Kernel posix-cpu-timers Non-leader exec...
CVE-2026-55825 Contao: Possible path traversal in job download URIs
Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The...
OPENSUSE-SU-2026:21487-1 Security update for tomcat10
This update for tomcat10 fixes the following issues: Update to Tomcat 10.1.57. Security issues fixed: - CVE-2026-59083: incorrect URL decoding in RewriteValve may allow security control bypass bsc1271397. - CVE-2026-59084: EncryptInterceptor requirements are not clearly documented bsc1271398. Oth...
CLEANSTART-2026-SK95653 Security fixes in kapp-controller 0.57.0-r0
Package kapp-controller version 0.57.0-r0 fixes 6 vulnerabilities: ghsa-hfvc-g4fc-pqhx, ghsa-p77j-4mvh-x3m3, ghsa-mh2q-q3fh-2475, CVE-2026-33186, CVE-2026-39883...
WordPress BookingPress Pro plugin < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering vulnerability
Unauthenticated Customer PII Disclosure and Booking Tampering vulnerability discovered by Kolja Zuelsdorf in WordPress Plugin BookingPress Appointment Booking Pro versions 5.7.3...
CVE-2026-65443
Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...
CVE-2026-65443
Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...
CVE-2026-65443 WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...
CVE-2026-51077
SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...
PT-2026-64853
The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...
EUVD-2026-48180
Unauthenticated Cross Site Scripting XSS in Grand Photography = 5.7.8 versions...
CVE-2026-60557
CVE-2026-60557 affects Oracle WebCenter Sites (Oracle Fusion Middleware) in versions 12.2.1.4.0 and 14.1.2.0.0. The issue allows an unauthenticated attacker with network access over HTTP to compromise WebCenter Sites, with human interaction required for exploitation. Impact per sources: potential...
CVE-2026-60457
...
CVE-2026-47057
The CVE-2026-47057 entry concerns Oracle Java SE (Scripting) with affected versions listed as 8u491, 8u491-perf, and 11.0.31. The vulnerability is exploitable over the network via multiple protocols and can allow an unauthenticated attacker to cause a hang or crash (complete DOS). The flaw can be...
CVE-2026-51027
An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component...