65272 matches found
CVE-2026-7761 Ultimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure
The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in getdirectorybyhash that allows any post to be used as a member directory ...
EUVD-2026-38714
The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in getdirectorybyhash that allows any post to be used as a member directory ...
CVE-2026-12485
creationtimestamp| type| source ---|---|--- 2026-06-24 06:45:28+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mozcwcekfw25 2026-07-16 19:00:28+00:00| seen| Telegram/v6zEHK1Gj8NlOFeo8YsfoG14SZcYTyMq60BoqtegyteCqb8 2026-07-17 01:00:26+00:00| seen|...
CVE-2022-28205
creationtimestamp| type| source ---|---|--- 2026-06-24 06:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mozchexunc2k...
EUVD-2026-38660
The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'newlink' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations...
CVE-2026-11370 WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter
The WP Meta SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.5.18 via the 'newlink' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations...
GHSA-44WP-G8F4-F4V5
creationtimestamp| type| source ---|---|--- 2026-06-24 04:42:12+00:00| seen| https://gist.github.com/alon710/f3efb3a6eb14f85378da7277ba2da374...
GHSA-6F75-X745-XCPR
creationtimestamp| type| source ---|---|--- 2026-06-24 02:11:40+00:00| seen| https://gist.github.com/alon710/3da2d0271b4ce13266c6eb8e48512bfd 2026-06-24 02:22:36+00:00| seen| https://gist.github.com/alon710/e0c0df432c86420f7e6e4e56d0b5a192...
CVE-2026-56116
A flaw was found in dhcpcd. An unauthenticated attacker on the same network link can exploit a memory leak vulnerability in the IPv6 Router Advertisement route information handling. By repeatedly sending specially crafted Router Advertisements with a zero lifetime, the attacker can cause the syst...
CVE-2026-54515
creationtimestamp| type| source ---|---|--- 2026-06-24 00:39:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moyoilsxlk2y 2026-06-29 13:58:37+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgnhh3jnf2d...
CVE-2026-54514
creationtimestamp| type| source ---|---|--- 2026-06-24 00:24:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moynnqc2bg23...
PT-2026-51936
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the fwctl component where incorrect class initialization ordering can lead to a NULL pointer dereference during device removal. Because CXL is linked before fwctl in t...
UNIX Symbolic Link (Symlink) Following
Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in the OpenAtNoFollow process. An attacker can cause unintended file ownership or permission changes on host files by placing a symlink in the virt-launcher filesystem, which is then followed via...
PT-2026-51737
The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs: 1 an MD5 hash fallback in get directory by hash that allows any post to be used as a member directo...
PT-2026-51669
Name of the Vulnerable Software and Affected Versions WP Meta SEO versions prior to 4.5.19 Description The plugin is susceptible to Server-Side Request Forgery SSRF, a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. Authenticated user...
PT-2026-52033
Name of the Vulnerable Software and Affected Versions Mistune versions prior to 3.3.0 Description A CPU exhaustion Denial of Service DoS occurs due to superlinear approximately On² behavior in the parse link text function. When processing Markdown containing numerous consecutive characters, the...
CVE-2026-48493
creationtimestamp| type| source ---|---|--- 2026-06-23 23:55:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moylygqbc626 2026-06-24 05:42:05+00:00| seen| https://gist.github.com/alon710/0deb8ac6eb09e699071fdbd4071e986c...
CVE-2026-54588
creationtimestamp| type| source ---|---|--- 2026-06-23 23:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moylpvwyu22t 2026-06-24 17:04:44+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mp2fjn4xgw2o 2026-07-02 02:05:18+00:00| seen|...
Snipe-IT's S3 signature image retrieval lacks authorization before temporary URL
Impact Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S3-backed deployments, authenticated users who know a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the authorize call used by the local-file branch. Key evidenc...