2938 matches found
Astra Linux – Vulnerability in hdf5
The HDF5 library from version 1.14.3 may use an uninitialized value in the H5Aattrreleasetable field within the H5Aint.c file...
EUVD-2026-54306
The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated users with subscriber-level access and above who are enrolled in at least one course to view paid lesson, quiz, and assignment content...
aiohttp < 3.14.2 HTTP Request Smuggling
The version of aiohttp installed on the remote host is prior to 3.14.2. It is, therefore, affected by a request smuggling vulnerability: - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attac...
CVE-2026-71555
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context e.g., target="blank" retain a window.opener referen...
CVE-2026-71555 PILOS: Reverse tabnabbing in room description
PILOS Platform for Interactive Live-Online Seminars is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context e.g., target="blank" retain a window.opener referen...
CVE-2026-66681
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...
CVE-2026-65544
Unauthenticated Cross Site Scripting XSS in Super Socializer = 7.14.5 versions...
CVE-2026-65542
Unauthenticated Broken Authentication in Super Socializer = 7.14.5 versions...
CVE-2026-28139
Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...
EUVD-2026-53893
Unauthenticated Cross Site Request Forgery CSRF in Theme My Login = 7.1.14 versions...
EUVD-2026-53890
Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.0 versions...
EUVD-2026-53974
Unauthenticated Cross Site Scripting XSS in Super Socializer = 7.14.5 versions...
EUVD-2026-53972
Unauthenticated Broken Authentication in Super Socializer = 7.14.5 versions...
CVE-2026-65542
CVE-2026-65542 concerns the WordPress WordPress Super Socializer plugin, affected versions
CLSA-2026-1785952964 TuxCare security update for org.springframework (14 CVEs)
TuxCare rebuilt 25 org.springframework packages to address 14 CVEs. Fixed in 6.2.15-tuxcare.3...
CVE-2026-71254
nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handlereadfilerecord function FC 0x14, Read File Record in nanomodbus.c. The function validates that the total request size does not exceed 245 bytes and that each sub-request's recordlength is at most 124, but i...
CVE-2026-18788
A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...
CLSA-2026-1777941827 TuxCare security update for com.fasterxml.jackson.core:jackson-core (3 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-core to address 3 CVEs. Fixed in 2.14.2-tuxcare.1...