1410 matches found
CLEANSTART-2026-QY50458 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface
Security vulnerability affects the fluent-operator package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...
CLEANSTART-2026-HW83607 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
Security vulnerability affects the fluent-operator package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
CLEANSTART-2026-JD49945 Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS
Security vulnerability affects the fluent-operator package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
CLEANSTART-2026-BO10826 ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
Security vulnerability affects the fluent-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...
CLEANSTART-2026-FI79899 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion
Security vulnerability affects the fluent-operator package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
CLEANSTART-2026-BL26881 Previously, resolving relative paths containing parent directory ('
Security vulnerability affects the fluent-operator package. Previously, resolving relative paths containing parent directory '...
PT-2026-105235
Security vulnerability affects the fluent-operator package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...
PT-2026-105217
Security vulnerability affects the fluent-operator package. Previously, resolving relative paths containing parent directory '...
PT-2026-105226
Security vulnerability affects the fluent-operator package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...
PT-2026-105250
Security vulnerability affects the fluent-operator package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...
PT-2026-105232
Security vulnerability affects the fluent-operator package. Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...
PT-2026-105231
Security vulnerability affects the fluent-operator package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...
PT-2026-105249
Security vulnerability affects the fluent-operator package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...
PT-2026-105218
Security vulnerability affects the fluent-operator package. The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label...
CVE-2026-94679
Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...
EUVD-2026-85484
Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...
CVE-2026-94679 WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...
CVE-2026-94679
The Fluent Support WordPress plugin, version 2.3.2 and below , is affected by a Broken Access Control vulnerability. This flaw allows for unauthorized actions within the subscriber context. No specific technical root cause, practical consequences, or remediation steps are provided in the availabl...
CVE-2026-86612 Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...
CVE-2026-86612 Ninja Tables < 5.2.17 - Unauthenticated Arbitrary Shortcode Execution via Fluent Forms Data Source
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting ...