CVE-2026-19223

CVE-2026-19223 affects the Smush WordPress plugin versions prior to 4.3.2 . The root cause is a missing authorization check: a network-wide setting is not restricted to network administrators. This means an administrator of any single site within a WordPress multisite network can execute arbitrar...

WordPress Smush plugin < 4.3.2 - Admin+ Network-Wide RCE vulnerability

Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Smush Image Compression and Optimization versions 4.3.2...

WordPress Defender Security plugin < 6.2.0 - Admin+ Network-Wide RCE vulnerability

Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Defender Security versions 6.2.0...

pi-hole

Bloqueo de anuncios en toda la red mediante tu propio hardware Linux Pi-hole® es un sumidero de DNS que protege tus dispositivos de contenido no deseado sin necesidad de instalar software en el cliente. Fácil de instalar : nuestros diálogos te guían a través del sencillo proceso de instalación en...

AdGuardHome

Centro di protezione della privacy per te e i tuoi dispositivi Server DNS gratuito e open source, potente, per bloccare annunci e tracker su tutta la rete. AdGuard.com | Wiki | Reddit | Twitter | Telegram AdGuard Home è un software a livello di rete per bloccare annunci e tracciamento. Dopo averl...

CVE-2026-73669

The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restriction. An unauthenticated attacker with network access to the bridge can read device data and control connected lights . ...

CVE-2026-65049

The CVE-2026-65049 issue affects Ninja Forms plugin for WordPress Multisite (version 3.14.8 and earlier). An incorrect authorization allows a subsite Administrator to trigger network-wide deletion of Ninja Forms data via admin-ajax.php with the nf_delete_all_data action, using a per-site nonce to...

EUVD-2026-46269

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration...

CVE-2026-53739

Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicatepostdismissnotice handler, which verifies no nonce or capability. Attackers can trick any authenticated user into sending a request that sets the duplicatepostshownotice site option, suppressing...

CVE-2026-53739

CVE-2026-53739 affects the WordPress plugin Yoast Duplicate Post up to version 4.6. The issue is a cross-site request forgery in the duplicate_post_dismiss_notice handler that does not verify a nonce or capability. This allows an attacker to trick an authenticated user into issuing a request that...

Google Workspace Vulnerabilities Lead to Network-Wide Breaches

By Deeba Ahmed The vulnerabilities were discovered by cybersecurity researchers at Bitdefender. This is a post from HackRead.com Read the original post: Google Workspace Vulnerabilities Lead to Network-Wide Breaches...

Using Velociraptor for large-scale endpoint visibility and rapid threat hunting

TL;DR Network-wide collection, acquisition and monitoring tool for use in DFIR engagements Designed for enterprise networks 150k+ Deployments aren’t unheard of Boasts many features that your commercial EDR has, and a few more Flexible querying language that can adapt to new threats and encourages...

CVE-2022-23513

Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on queryads endpoint. In the case of application, this...

Code injection

Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on queryads endpoint. In the case of application, this...

CVE-2022-23513

CVE-2022-23513 affects Pi-hole AdminLTE (Pi-hole Web Interface). The issue is an access-control vulnerability in the queryads endpoint exposed via root-path PHP script /admin/scripts/pi-hole/phpqueryads.php, where insufficient validation allows an attacker to perform unauthorized queries for bloc...

Command Execution Vulnerability in Netnifty Vulnerability Scanning System

Beijing Netnifty Information Technology Co., Ltd. covers network border security protection, application and data security protection, network security risk management, professional security solutions and professional security services. A command execution vulnerability exists in the Netnifty...

Pi-hole cross-site scripting vulnerability (CNVD-2021-30595)

Pi-hole is a multi-platform, network-wide ad-blocking tool. A stored cross-site scripting vulnerability exists in Pi-hole 5.4 and earlier versions of the management portal. An attacker with network access to a DNS server could exploit this vulnerability to conduct a cross-site scripting attack...

Pi-hole cross-site scripting vulnerability (CNVD-2021-14160)

Pi-hole is a multi-platform, network-wide ad-blocking tool. A cross-site scripting vulnerability exists in Pi-hole 5.0, 5.1, 5.1.1. The vulnerability stems from insufficient validation of user-supplied data. An attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...

USN-3215-2: Munin regression

USN-3215-1 fixed a vulnerability in Munin. The upstream patch caused a regression leading to errors being appended to the log file. This update fixes the problem. Original advisory details: It was discovered that Munin incorrectly handled CGI graphs. A remote attacker could use this issue to...

Debian DLA-836-2 : munin regression update

The update for munin issued as DLA-836-1 caused a regression in the zooming functionality in munin-cgi-graph. Updated packages are now available to correct this issue. For reference, the original advisory text follows. Stevie Trujillo discovered a command injection vulnerability in munin, a...