CVE-2026-56766 Hydra - Stack Buffer Overflow in NTLM Authentication Handler

Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing malicious NTLM Type-2 challenges. A malicious server can send a crafted NTLM Type-2 challenge with an...

CVE-2026-56766

Hydra before 9.7 contains a stack buffer overflow in the NTLM authentication handler used by SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules when processing crafted NTLM Type-2 challenges. A malicious server can send a long domain in NTLM Type-2, overflowing a 500-byte st...

CVE-2026-42675

Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41...

GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, flux, step-issuer, glab, prometheus, traefik, karpenter, crossplane-provider-azure-storage, fq, prometheus-operator, cilium, vale, caddy, gptscript, kubernetes-dashboard, hydra, zot, minio, ingress-nginx-controller, step, gitea, kine,...

CVE-2026-42506 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, flux, step-issuer, glab, prometheus, traefik, karpenter, crossplane-provider-azure-storage, fq, prometheus-operator, cilium, vale, caddy, gptscript, kubernetes-dashboard, hydra, zot, minio, ingress-nginx-controller, step, gitea, kine,...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, flux, step-issuer, glab, prometheus, traefik, karpenter, crossplane-provider-azure-storage, fq, prometheus-operator, cilium, vale, caddy, gptscript, kubernetes-dashboard, hydra, zot, minio, ingress-nginx-controller, step, gitea, kine,...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, flux, step-issuer, glab, prometheus, traefik, karpenter, crossplane-provider-azure-storage, fq, prometheus-operator, cilium, vale, caddy, gptscript, kubernetes-dashboard, hydra, zot, minio, ingress-nginx-controller, step, gitea, kine,...

CVE-2026-25681 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, flux, step-issuer, glab, prometheus, traefik, karpenter, crossplane-provider-azure-storage, fq, prometheus-operator, cilium, vale, caddy, gptscript, kubernetes-dashboard, hydra, zot, minio, ingress-nginx-controller, step, gitea, kine,...

GHSA-5CV4-JP36-H3MW vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, flux, step-issuer, glab, prometheus, traefik, karpenter, crossplane-provider-azure-storage, fq, prometheus-operator, cilium, vale, caddy, gptscript, kubernetes-dashboard, hydra, zot, minio, ingress-nginx-controller, step, gitea, kine,...

CVE-2026-42502 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, flux, step-issuer, glab, prometheus, traefik, karpenter, crossplane-provider-azure-storage, fq, prometheus-operator, cilium, vale, caddy, gptscript, kubernetes-dashboard, hydra, zot, minio, ingress-nginx-controller, step, gitea, kine,...

CVE-2026-25680 vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, flux, step-issuer, glab, prometheus, traefik, karpenter, crossplane-provider-azure-storage, fq, prometheus-operator, cilium, vale, caddy, gptscript, kubernetes-dashboard, hydra, zot, minio, ingress-nginx-controller, step, gitea, kine,...

GHSA-W9P8-PVXH-RXPJ vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, flux, step-issuer, glab, prometheus, traefik, karpenter, crossplane-provider-azure-storage, fq, prometheus-operator, cilium, vale, caddy, gptscript, kubernetes-dashboard, hydra, zot, minio, ingress-nginx-controller, step, gitea, kine,...

GHSA-WRH2-89VG-4J9G vulnerabilities

Vulnerabilities for packages: grafana-pyroscope, flux, step-issuer, glab, prometheus, traefik, karpenter, crossplane-provider-azure-storage, fq, prometheus-operator, cilium, vale, caddy, gptscript, kubernetes-dashboard, hydra, zot, minio, ingress-nginx-controller, step, gitea, kine,...

CVE-2026-42675

Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41...

EUVD-2026-33688

Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41...

CVE-2026-42675 WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41...

CVE-2026-42675 WordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41...

CVE-2026-42675

CVE-2026-42675 affects the WordPress Hydra Booking plugin (versions

PT-2026-45462

Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41...

WordPress plugin Hydra Booking 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...