312576 matches found
CVE-2026-76057 AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action
The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an...
CVE-2026-76057
The AutomatorWP – Automator WordPress plugin (no-code automations, webhooks & custom integrations) is vulnerable to authorization bypass in all versions up to and including 5.8.4 . The root cause is a missing authorization check on the automatorwp_convertkit_get_forms AJAX action: the required no...
apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation
A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...
GHSA-GJ76-H2CH-5M76
creationtimestamp| type| source ---|---|--- 2026-08-22 00:43:30+00:00| seen| https://bsky.app/profile/webknjaz.me/post/3mtn27ckwcs2g 2026-08-22 00:43:32+00:00| seen| https://bsky.app/profile/webknjaz.mastodon.social.ap.brid.gy/post/3mtn27bxi3wh2...
PT-2026-79588
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt re: zero shared page before exposing to userspace bnxt re alloc ucontext allocates uctx-shpg via get free pageGFP KERNEL. The buddy allocator does not zero pages without GFP ZERO, so the page contains stale kernel data...
Linux Distros Unpatched Vulnerability : CVE-2026-77219
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafte...
PT-2026-79603
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix Route Information option length validation rt6 route rcv validates the Route Information option RFC 4191 length against the prefix length, but both checks are off by one. rinfo-length is the ND option length in units of...
PT-2026-79664
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mrp: fix uninitialised bytes on the wire br mrp alloc test skb builds MRP test frames on an skb from dev alloc skb, which does not clear the linear data area. On the MRA ring-role branch the sub-option TLV header is...
PT-2026-79608
In the Linux kernel, the following vulnerability has been resolved: ptp: ocp: Fix board ID over-read The EEPROM board ID is a fixed 13-byte field and is not guaranteed to contain a NUL terminator. Passing it directly to devlink info version fixed put treats it as a C string and may read beyond th...
PT-2026-79678
In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdev pass values In evdev pass values, the input event structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures wher...
Linux Distros Unpatched Vulnerability : CVE-2026-74673
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: evdev - fix information leak in evdevpassvalues In evdevpassvalues, the inputevent structure is allocated on the kernel stack and populated field-by-fiel...
Linux Distros Unpatched Vulnerability : CVE-2026-74598
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: fix Route Information option length validation rt6routercv validates the Route Information option RFC 4191 length against the prefix length, but both chec...
Linux Distros Unpatched Vulnerability : CVE-2026-74659
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bridge: mrp: fix uninitialised bytes on the wire brmrpalloctestskb builds MRP test frames on an skb from devallocskb, which does not clear the linear data...
Linux Distros Unpatched Vulnerability : CVE-2026-74694
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/ncsi: fix heap OOB read in NCSICMDSENDCMD payload length ncsisendcmdnl takes the number of bytes to copy from the attacker-controlled ncsipkthdr.length fiel...
PT-2026-79624
Content removed...
PT-2026-79699
In the Linux kernel, the following vulnerability has been resolved: net/ncsi: fix heap OOB read in NCSI CMD SEND CMD payload length ncsi send cmd nl takes the number of bytes to copy from the attacker-controlled ncsi pkt hdr.length field of the in-band packet header, while the source buffer is th...
SUSE SLED15: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:3658-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3658-1 advisory. Update to Firefox Extended Support Release 140.14.0 ESR. - MFSA 2026-74 bsc1274867 - CVE-2026-74934: Site...
CVE-2026-48050
Arc (an open SQL-native time-series database for telemetry) versions prior to 26.06.1 expose Go's net/http/pprof debug endpoints at /debug/pprof/* without authentication. The root cause is that /debug/pprof is added to PublicPrefixes in cmd/arc/main.go, causing the auth middleware to short-circui...
CVE-2026-53497
CrossWatch CW is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the othersessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and...