7324 matches found
WordPress Download Monitor plugin < 5.2.6 - Unauthenticated Download Log Injection vulnerability
Unauthenticated Download Log Injection vulnerability discovered by Anirudh Gupta in WordPress Plugin Download Monitor versions 5.2.6...
WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting
A cross-site scripting vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI. id: CVE-2012-4768 info: name: WordPress Plugin Download Monitor 3.3.5.9 - Cross-Site...
Download Monitor <= 4.7.60 - Sensitive Information Exposure
The Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.7.60 via REST API. This can allow unauthenticated attackers to extract sensitive data including user reports, download reports, and user data including email, role, id and...
WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass
In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6671 info: name: WhatsUp Gold GetStatisticalMonitorList SQL Injectio...
Download Monitor < 4.4.5 - SQL Injection
The Download Monitor plugin for WordPress is vulnerable to SQL injection via the 'orderby' parameter in versions before 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attacker...
Campaign Monitor for WordPress - Information Disclosure
Campaign Monitor for WordPress plugin for WordPress versions up to 2.8.15 contains a full path disclosure caused by improper access restriction and enabled displayerrors in /forms/views/admin/create.php, letting unauthenticated attackers retrieve server paths, exploit requires displayerrors to be...
IRTS OP5 Monitor - Cross-Site Scripting
OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting XSS. id: CVE-2021-40272 info: name: IRTS OP5 Monitor - Cross-Site Scripting author: ritikchaddha severity: medium description: | OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting XSS. impac...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: kwok, istio, kubescape, cluster-api-provider-vsphere, k3s, rke2-cloud-provider, calico, kuma, fluent-operator, cluster-api-aws-controller, zot, flux-helm-controller, kubernetes-csi-external-resizer, cert-manager-istio-csr, opentelemetry-operator, cluster-autoscaler,...
Monitorr 1.7.6m - Unauthenticated Remote Code Execution
Monitorr 1.7.6m is susceptible to a remote code execution vulnerability. Improper input validation and lack of authorization leads to arbitrary file uploads in the web application. An unauthorized attacker with web access to could upload and execute a specially crafted file, leading to remote cod...
UBUNTU-CVE-2026-72335
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...
CVE-2026-72335 Bluetooth: MGMT: Fix adv monitor add failure cleanup
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...
CVE-2026-72335 Bluetooth: MGMT: Fix adv monitor add failure cleanup
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...
EUVD-2026-59234
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hciaddadvmonitor publishes a new advmonitor in hdev-advmonitorsidr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...
CVE-2026-72335
CVE-2026-72335 — Linux kernel Bluetooth MGMT fix : The vulnerability is in the MGMT path used by the Bluetooth HCI management code when adding a new adv_monitor. In hci_add_adv_monitor, an adv_monitor is published in hdev->adv_monitors_idr before the powered MSFT offload setup. If the MSFT add...
PT-2026-72371
In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCK SCOPE SIGNAL bypass on the SIGIO path LANDLOCK SCOPE SIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery...
PT-2026-72523
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci add adv monitor publishes a new adv monitor in hdev-adv monitors idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the...
GO-2025-3955 vulnerabilities
Vulnerabilities for packages: conftest, grafana-alloy, cni-plugins, swagger, cluster-api-provider-vsphere, k3s, caddy, pluto, aws-eks-pod-identity-agent, helm-set-status, nodetaint, regclient, nri-mysql, clickhouse-operator, falcoctl, ini-file, aws-application-networking-k8s, thanos-operator, opa...
CVE-2026-72673 Incorrect Authorization in Kibana Leading to Unauthorized Deletion of Synthetics Private Locations
Incorrect Authorization CWE-863 in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is...
CVE-2026-19311 Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...
EUVD-2026-57420
Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters...