74729 matches found
WP < 7.1.1 - Theme Installation via CSRF
Description WordPress does not properly handle a parameter of the theme installer screen in some cases, which could allow attackers to make a logged in administrator install a theme from the WordPress.org directory via a crafted link...
CVE-2026-81178: Incorrect Authorization
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and...
The vulnerability of the Rsync file transfer and synchronization utility lies in the improper handling of symbolic links before accessing files. This allows attackers to circumvent existing security restrictions.
The vulnerability of the Rsync file transfer and synchronization utility is related to the incorrect handling of symbolic links before accessing files. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions remotely...
CVE-2026-87767: Improper Neutralization of Special Elements used in an SQL Command
The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available to unauthenticated users, allowing unauthenticated attackers to perform SQL injection attacks and extract sensitive data...
PT-2026-95242
Name of the Vulnerable Software and Affected Versions wp shortcut link and advertisement baner WordPress plugin versions prior to 1.2.1 Description An issue exists where a parameter is not sanitized or escaped before being used in a SQL query within an AJAX action accessible to unauthenticated...
PT-2026-96729
Name of the Vulnerable Software and Affected Versions D-Link DAP-1360 versions 6.14 and earlier Description An unauthenticated remote code execution issue exists in the web management interface. Remote attackers can execute arbitrary commands with root privileges by sending crafted HTTP requests ...
Linux Distros Unpatched Vulnerability : CVE-2026-92474
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gfinlinegetprotolib of the file src/compositor/mpeg4inline.c of the component...
PT-2026-95634
Name of the Vulnerable Software and Affected Versions cockpit-files versions prior to 44-1.1 Description A flaw in the "Paste as owner" function allows a low-privileged local user to change arbitrary file ownership outside the intended directory. This is achieved by crafting a directory containin...
ROS-20260918-73-0001
The vulnerability in Docker CE is related to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow an attacker to increase their privileges...
CVE-2026-81182: Authorization Bypass Through User-Controlled Key
SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The...
CVE-2026-87965: Improper Access Control
The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who...
PT-2026-95410
Name of the Vulnerable Software and Affected Versions Zephyr affected versions not specified Description The net icmpv6 send error function in subsys/net/ip/icmpv6.c fails to implement all RFC 4443 section 2.4 suppression rules, which dictate that an ICMPv6 error should not be answered with anoth...
PT-2026-95582
Name of the Vulnerable Software and Affected Versions SysReptor versions prior to 2026.68 Description An unauthenticated attacker with a public read-write note share link can disclose uploaded files or images within the same project. By updating the shared note to reference a specific target asse...
MAL-2026-16270 Malicious code in @tink/tink-link-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf The package impersonates the Tink open-banking SDK name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage...
Malicious code in @tink/tink-link-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf The package impersonates the Tink open-banking SDK name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage...
AZL-101858 CVE-2026-90392 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...
CVE-2026-90392
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...
DEBIAN-CVE-2026-90349
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996tx When mac80211 leaves the link unspecified, mt7996tx substitutes the primary link id of the station or vif. That value is IEEE80211LINKUNSPECIFIED 0xf until the...
oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing
Summary oras-go's pagination helper parseLink in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host e.g., a cloud metadata...
