311543 matches found
EUVD-2026-62271
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...
EUVD-2026-62274
The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users with at least the Subscriber role to read the titles of private and draft posts by ID and to enumerate stored post-meta key names...
EUVD-2026-62269
The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable by unauthenticated users, allowing anyone to read the store's order totals and its vendors' earnings, balance ledgers, and...
CVE-2026-14826 Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR
The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...
CVE-2026-14826
The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 lacks per-object ownership checks on REST routes, allowing contributor-level users to read other users' quiz notification recipient addresses via IDOR. Exploitation details are not provided. Upgrade to QSM 11.2.4 to remediate.
EUVD-2026-62266
The Quiz and Survey Master QSM WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notification and results-page configuration, allowing users with contributor-level access and above to read the configuration, including...
CVE-2026-72127
A flaw was found in the Linux kernel's netdev-genl component. A local user in a child process ID PID namespace can issue a NETDEVCMDNAPIGET command. This allows the user to observe the global PID of a NAPI kernel thread, even though the thread should not be visible within their PID namespace. Thi...
GHSA-2QJ4-MMR9-4V2F vulnerabilities
Vulnerabilities for packages: trino, tez, thingsboard, celeborn, management-api-for-apache-cassandra-5.0...
CVE-2026-71491 vulnerabilities
Vulnerabilities for packages: airflow, mlflow, mycli...
MINI-G6PM-C338-C2MV
Bulletin has no description...
PT-2026-78380
Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection, allows a low privileged attacker with remote access to potentially cause...
PT-2026-78378
Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An Improper Restriction of XML External Entity Reference XXE occurs, where the application fails to properly restrict external entity references within XML documents. A low...
CVE-2026-74954
Information disclosure due to side-channel in the Storage: Cache API c...
PT-2026-78392
Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient sanitization of HTML in FAQ answers occurs before generating PDFs via TCPDF. An attacker with permissions to create or edit FAQ content can embed an tag with a src attribute referencing...
PT-2026-78592
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM PowerVM VIOS version 4.1 Description A remote authenticated attacker can obtain sensitive information and cause a denial of service. This is possible due to an out-of-bounds write, which occurs when a program...
EUVD-2026-62482
An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the apivedo/chat endpoint and the utentechat parameter...
Linux Distros Unpatched Vulnerability : CVE-2026-74954
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154,...
Linux Distros Unpatched Vulnerability : CVE-2026-74966
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
RockyLinux 8 : pam (RLSA-2026:56131)
The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:56131 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly...