256215 matches found
PT-2026-103701
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...
PT-2026-103905
Name of the Vulnerable Software and Affected Versions Fortra Core Privileged Access Manager BoKS versions prior to 8.1.0.24 Fortra Core Privileged Access Manager BoKS versions prior to 9.0.0.7 Description A stack-based buffer overflow exists in the boks autoregisterd service. A remote attacker wi...
CVE-2026-64950: Improper Neutralization of Input During Web Page Generation
Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing without user interaction. Affects Pandora FMS from 777 onwards...
CVE-2026-79896: Out-of-bounds Read
Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boksportmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boksportmux. Although the daemon is normally restarted automatically, repeated requests can...
PT-2026-103907
Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks portmux. Although the daemon is normally restarted automatically, repeated requests c...
Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel / etc Multiple Vulnerabilities (crlsa-2024_9644)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20249644 advisory. squid: vulnerable to a Denial of Service attack against Cache Manager error responses CVE-2024-23638 squid: Denial of Service processing ESI response conte...
Linux Distros Unpatched Vulnerability : CVE-2026-102904
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5....
Debian dla-4808 : network-manager-l2tp - security update
The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4808 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4808-1 [email protected]...
AlmaLinux 9.2 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1736860159)
The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1736860159 advisory. - Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denia...
CVE-2026-19902: Improper Neutralization of Input During Web Page Generation
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...
CVE-2026-64949: Unrestricted Upload of File with Dangerous Type
Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandora FMS from 777 onwards...
CVE-2026-62063: Missing Authorization
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1...
CVE-2026-64946: Improper Neutralization of Input During Web Page Generation
A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling session cookie exfiltration and administrator account takeover. This issue affects Pandora FMS: from 777 onwards...
PT-2026-103765
A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...
PT-2026-103740
Name of the Vulnerable Software and Affected Versions Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.19 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a site administrator...
PT-2026-103893
Subscriber Broken Access Control in WP Project Manager = 4.0.7 versions...
Rocky Linux 8 [CIQ] Security Update: 389-ds-base / 389-ds-base-debuginfo / 389-ds-base-debugsource / etc Multiple Vulnerabilities (crlsa-2026_64791)
The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202664791 advisory. 389-ds-base: 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasliostartpacket CVE-2026-18355 389-ds-base:...
CVE-2026-79898: Improper Neutralization of Special Elements used in an OS Command
Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master...
CVE-2026-86610: Improper Neutralization of Input During Web Page Generation
The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...