sigstore-python Cross-Site Request Forgery Vulnerability

sigstore-python is an open-source tool developed by sigstore for generating and verifying Sigstore signatures in Python. Versions of sigstore-python prior to 4.2.0 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the OAuth authentication process’s...

EUVD-2026-4275

MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for thread redirects. Attackers can inject malicious SVG scripts that will execute when other users view the thread, allowing arbitrary script execution...

CVE-2026-22426

creationtimestamp| type| source ---|---|--- 2026-01-22 17:46:11+00:00| seen| https://gist.github.com/Darkcrai86/1dd9289803bef694101f7f5241b901ce...

CVE-2026-24380 WordPress EventPrime plugin <= 4.2.8.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through = 4.2.8.0...

PT-2026-4220

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in pavothemes Freshio freshio allows PHP Local File Inclusion.This issue affects Freshio: from n/a through = 2.4.2...

VulnCheck KEV: CVE-2024-4443

The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘listingfields’ parameter in all versions up to, and including, 6.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001537)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001537 advisory. A flaw incorrect umask during file or directory modification in the Linux kernel NFS network file system functionality was found in the way user create and delete...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000817)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000817 advisory. The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service host OS panic or hang by...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004057)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004057 advisory. A flaw incorrect umask during file or directory modification in the Linux kernel NFS network file system functionality was found in the way user create and delete...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001384)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001384 advisory. fpregsstatevalid in arch/x86/include/asm/fpu/internal.h in the Linux kernel before 5.4.2, when GCC 9 is used, allows context-dependent attackers to cause a denial of...

iFunbox code issues and vulnerabilities

iFunbox is a file management software for Apple products developed by iFunbox Inc. in China. Version 4.2 of iFunbox contains a code vulnerability. This vulnerability stems from an unquoted service path in the Apple Mobile Device Service, which may lead to an increase in local privileges...

CVE-2026-21918

A Double Free vulnerability in the flow processing daemon flowd of Juniper Networks Junos OS on SRX and MX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service DoS. On all SRX and MX Series platforms, when during TCP session establishment a specific sequence of...

CVE-2025-60007

A NULL Pointer Dereference vulnerability in the chassis daemon chassisd of Juniper Networks Junos OS on MX, SRX and EX Series allows a local attacker with low privileges to cause a Denial-of-Service DoS. When a user executes the 'show chassis' command with specifically crafted options, chassisd...

PT-2026-3129

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on SRX Series versions 23.2R2-S2 through 23.2R2-S4 Juniper Networks Junos OS on SRX Series versions 23.4R2-S1 through 23.4R2-S4 Juniper Networks Junos OS on SRX Series versions prior to 24.2R2-S2 Juniper Networks Juno...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001887)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001887 advisory. The slhcinit function in drivers/net/slip/slhc.c in the Linux kernel through 4.2.3 does not ensure that certain slot numbers are valid, which allows local users to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001051)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001051 advisory. The rfcommsockbind function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of...

WordPress tagDiv Composer plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin tagDiv Composer versions = 5.4.2...

EUVD-2026-1672

The Open eClass platform formerly known as GUnet eClass is a complete course management system. Prior to version 4.2, an arbitrary file upload vulnerability in the theme import functionality enables an attacker with administrative privileges to upload arbitrary files on the server's file system...

CVE-2026-22241

The CVE concerns Open eClass (GUnet eClass) before version 4.2, where an arbitrary file upload vulnerability in the theme import feature allowed an attacker with administrative privileges to place files on the server’s filesystem. The root cause is lack of validation/sanitization of files inside ...

CVE-2019-25296

The CVE-2019-25296 entry concerns the WP Cost Estimation WordPress plugin up to version 9.642, where missing file type validation in the lfb_upload_form and lfb_removeFile AJAX actions allows unauthenticated arbitrary file uploads and deletions. This can enable uploading arbitrary files to the se...