4453 matches found
PT-2026-69277
Name of the Vulnerable Software and Affected Versions PiWeb Cancel order / Refund request for WooCommerce WordPress plugin versions prior to 1.3.4.34 Description Lack of authorization and ownership checks when adding previous order contents to the cart allows unauthenticated users to disclose the...
PT-2026-69106
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Lack of authentication for Very High Frequency Data Link VHFDL messages allows rogue ground stations to inject Controller-Pilot Data Link Communications CPDLC...
Adversarial Clothing Designed to Fool Facial Recognition Systems
There are many companies manufacturing adversarial clothing designed to confuse facial recognition systems. It's a cool idea, but I worry that it's mostly security theater: "Our patterns play with that chaos, confuse algorithms and make it way harder to pin you down," he said. Bell, however, said...
EUVD-2026-53778
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid WARNING in sva unbind path The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 "iommu/vt-d: Only handle IOPF for SVA when PRI is supported" modified the SVA bind...
CVE-2026-48084: Improper Restriction of Excessive Authentication Attempts
OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2...
PT-2026-68051
Name of the Vulnerable Software and Affected Versions Typemill affected versions not specified Description The login endpoint 'POST /tm/login' using the login function in ControllerWebAuth lacks rate-limiting, failed-attempt counting, and account lockout mechanisms when the captcha is disabled,...
CVE-2026-13596
The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-28814
Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue...
PT-2026-76060
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-48 and 7.1.2-23, the distributed pixel cache was originally designed to operate without a challenge–response authentication model. This has been changed in versions 6.9.13-48 an...
CVE-2026-13306 Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability
Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability. This vulnerability allows physically present attackers to bypass authentication on affected installations of Autel MaxiCharger AC Elite Home EV chargers. Authentication is not required to exploit this vulnerability. The...
EUVD-2026-50499
ATEN Unizon RpcProvider Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ATEN Unizon. Authentication is not required to exploit this vulnerability. The specific flaw exists withi...
Oracle WebCenter Enterprise Capture Client Bundle Full Control
The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker...
Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS Detection
Adminer = 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Adminer = 5.""" from kittysploit impo...
JustBoil.me Images Plugin - Exposed Image Upload Detection
JustBoil.me Images Plugin for TinyMCE contains an exposed dialog interface that could lead to potential security vulnerabilities. The plugin's dialog-v4.htm file is accessible without proper access controls, which may allow unauthorized access to image upload functionality. !/usr/bin/env python3 ...
CVE-2026-17528
CVE-2026-17528 affects the nice-select2 JavaScript plugin. Versions before 2.4.1 are vulnerable to XSS via the element, where a malicious payload is rendered into the DOM and can execute arbitrary scripts in a user’s browser when interacting with affected pages. The issue is tied to insufficient...
CVE-2026-64208: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...
MINI-MMM6-X4F2-Q99V
Bulletin has no description...
GO-2026-6018 Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper
Skipper's routesrv-no-auth component: All routesrv API Endpoints Lack Authentication in github.com/zalando/skipper...
DEBIAN-CVE-2026-55990
In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when the 'dnscrypt:' clause lists more 'dnscrypt-provider-cert:' files than there are matching 'dnscrypt-secret-key:' files, Unbound fills only the matched prefix and leaves the tail slots at the '0xdb' fill that libsodium's allocator writes...
