2960 matches found
EUVD-2026-43097
Phalcon: Non-constant-time HMAC verification in Encryption\Crypt::decrypt timing side-channel...
ROOT-OS-DEBIAN-12-CVE-2023-29934 CVE-2023-29934 in llvm-toolchain-14 - Patched by Root
Root has patched CVE-2023-29934 in the llvm-toolchain-14 package for Root:Debian:12. Multiple fixed versions available...
Astra Linux – Vulnerability in Nasm
In libnasm.a of Netwide Assembler NASM 2.14.xx, asm/pragma.c allows for a NULL pointer dereferencing in processpragma, searchpragmalist, and nasmsetlimit when "%pragma limit" is mishandled...
Astra Linux – Vulnerability in Linux
A vulnerability was discovered in the Linux kernel in versions prior to v5.14-rc1. Missing size validations on inbound SCTP packets may allow the kernel to read uninitialized memory...
Astra Linux – Vulnerability in cifs-utils
In cifs-utils up to version 6.14, a stack-based buffer overflow occurs when parsing the mount.cifs ip= command-line argument. This vulnerability could allow local attackers to gain root privileges...
Astra Linux – Vulnerability in Redis
Redis is an open-source, in-memory database that persists data on disk. A integer overflow bug that affects all versions of Redis can be exploited to corrupt the heap and potentially be used to leak arbitrary contents of the heap or trigger remote code execution. The vulnerability involves changi...
Astra Linux – Vulnerability in WebKit2GTK
A logic issue has been addressed through improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4, and iPadOS 14.4. A remote attacker may be able to execute arbitrary code. Apple is aware of a report indicating...
EUVD-2026-54306
The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...
aiohttp < 3.14.2 HTTP Request Smuggling
The version of aiohttp installed on the remote host is prior to 3.14.2. It is, therefore, affected by a request smuggling vulnerability: - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attac...
CVE-2026-71555
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context e.g., target="blank" retain a window.opener referen...
CVE-2026-71555 PILOS: Reverse tabnabbing in room description
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context e.g., target="blank" retain a window.opener referen...
CVE-2026-66681
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...
CVE-2026-65544
Unauthenticated Cross Site Scripting XSS in Super Socializer = 7.14.5 versions...
CVE-2026-65542
Unauthenticated Broken Authentication in Super Socializer = 7.14.5 versions...
CVE-2026-28139
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
EUVD-2026-53893
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...
EUVD-2026-53890
Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.0 versions...
EUVD-2026-53974
Unauthenticated Cross Site Scripting XSS in Super Socializer = 7.14.5 versions...
