28458

CVE-2020-28458 Affected versions of this package are vulnerable to Prototype Pollution. datatables v1.10.16-1.10.16 Usage Run the Python script and enter the required inputs: Target URL Proxy URL optional, leave blank if none Timeout in seconds default 10 Example: python3 exploit.py The script us...

CVE-2026-126091

Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3...

EUVD-2026-125589

Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3...

CVE-2026-126091

Dental practice websites hosted with iDentalSoft are vulnerable to sensitive information exposure. The software sends a JSON response to any user who loads specific pages, potentially revealing OAuth credentials , password hashes , and Personally Identifiable Information (PII) . This vulnerabilit...

CVE-2026-126091 iDentalSoft website information exposure

Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3...

PT-2026-146997

Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3...

CVE-2026-127046

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /externaltools/list endpoint returned stored API keys the apikey field in its JSON response via the ExternalTools model serializer. Additionally, the browser-based...

EUVD-2026-124365

The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /externaltools/list endpoint returned stored API keys the apikey field in its JSON response via the ExternalTools model serializer. Additionally, the browser-based...

PT-2026-145772

Name of the Vulnerable Software and Affected Versions MISP Modules affected versions not specified Description The website component of MISP Modules contains an information disclosure flaw within the external tools management interface. The '/external tools/list' endpoint returns stored API keys...

CVE-2026-112072

vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser that has no nesting depth limit. A deeply nested value raises a StackOverflowError, which escapes catch Exception handlers and kills the reading thread. A Vault token that can...

CVE-2026-103915

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable...

EUVD-2026-114671

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable...

CVE-2026-103915 Booking for Appointments and Events Calendar <= 2.4.12 - Unauthenticated Sensitive Information Exposure in 'page' Parameter

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable...

CVE-2026-103915

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 2.4.12 . The flaw exists within the 'page' parameter , where the raw providers array is never stripped before output. This allows unauthen...

PT-2026-134482

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia plugin for WordPress versions prior to 2.4.13 Description Unauthenticated attackers can extract personally identifiable information of staff members, including full names, email addresses,...

CVE-2026-103915: melograno Booking for Appointments and Events Calendar – Amelia: The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information…

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.12 via the 'page' parameter. This makes it possible for unauthenticated attackers to extract staff personally identifiable...

GO-2026-6690 Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza...

PT-2026-118012

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion in github.com/corazawaf/coraza...

CVE-2026-107833

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) contains an unbounded recursion vulnerability in the ProcessResponse function located in internal/bodyprocessors/json.go. The root cause is that the ignoreJSONRecursionLimit value of -1 is passed to readJSON, while the recursive guard o...

CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...