750 matches found
EUVD-2026-64130
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate resolves and calls Python objects selected by configuration through resolvetarget in hydra/internal/instantiate/instantiate2.py, allowing attacker-controlled target values and arguments to...
CVE-2026-68508 Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate resolves and calls Python objects selected by configuration through resolvetarget in hydra/internal/instantiate/instantiate2.py, allowing attacker-controlled target values and arguments to...
PT-2026-79449
Name of the Vulnerable Software and Affected Versions Hydra versions prior to 1.3.4 Description The hydra.utils.instantiate function resolves and calls Python objects selected by configuration through the resolve target function in hydra/ internal/instantiate/ instantiate2.py. This allows...
WordPress Hydra Booking plugin <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter vulnerability
Authenticated Host+ Stored Cross-Site Scripting via 'firstname' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Hydra Booking versions = 1.2.2...
CVE-2026-15948
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15948
The CVE-2026-15948 entry concerns the Hydra Booking WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in the first_name parameter for all versions up to and including 1.2.2 due to insufficient input sanitization and output escaping. The tfhb_host role can be self-assigned via t...
EUVD-2026-58861
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15948 Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-15948
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-72152
Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar versions prior to 1.2.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows attackers to inject arbitrary web...
GO-2026-4807 vulnerabilities
Vulnerabilities for packages: hydra, hydra-fips...
GO-2025-3987 vulnerabilities
Vulnerabilities for packages: hydra, weaviate, hydra-fips...
GO-2026-5028 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, istio, grafana, net-kourier, ingress-nginx-controller-fips, frankenphp-8.2, gitlab-rails-ce, gitlab-workhorse-ce, prometheus-mongodb-exporter, crossplane-provider-aws-route53recoverycontrolconfig-fips, kubernetes-dashboard,...
GO-2026-5027 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, istio, grafana, net-kourier, ingress-nginx-controller-fips, frankenphp-8.2, gitlab-rails-ce, gitlab-workhorse-ce, prometheus-mongodb-exporter, crossplane-provider-aws-route53recoverycontrolconfig-fips, kubernetes-dashboard,...
GO-2026-5029 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-elasticache, istio, grafana, net-kourier, ingress-nginx-controller-fips, frankenphp-8.2, gitlab-rails-ce, gitlab-workhorse-ce, prometheus-mongodb-exporter, crossplane-provider-aws-route53recoverycontrolconfig-fips, kubernetes-dashboard,...
GO-2026-4807 vulnerabilities
Vulnerabilities for packages: hydra...
GO-2025-3987 vulnerabilities
Vulnerabilities for packages: weaviate, hydra...
GO-2026-5025 vulnerabilities
Vulnerabilities for packages: kubernetes-dashboard, crossplane-provider-aws-elasticache, fq, karpenter, kubernetes, snyk-cli, terraform-provider-acme, external-secrets-operator, caddy, k3s, kine, hubble, kyverno, telegraf, mattermost, vale, traefik, grafana-pyroscope, kots, step, step-issuer,...