28959 matches found
EUVD-2026-52582
The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers...
CVE-2026-14816
The GDPR Framework WordPress plugin prior to 2.4.0 allows unauthenticated attackers to forge consent records for arbitrary emails and flood the privacy-request queue due to improper authorization/identity verification when recording cookie-consent choices and privacy requests. Upgrade to version ...
CVE-2026-18722
Technical details (affected product, vulnerable component, root cause, impact, fixes) are not publicly available in the provided documents; monitor for updates.
EUVD-2026-52565
A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The explo...
sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation
A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...
EUVD-2026-52416
A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the file /fort/portallogin of the component Login Endpoint. This manipulation causes os command...
CVE-2026-18568
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...
CVE-2026-0392
eParakstītājs 3.0 for Windows prior to 1.10.0 is vulnerable: its auto-update uses an unauthenticated/integrity-free channel. The client fetches an XML update descriptor over TLS while accepting any certificate, with no verification of the descriptor’s digital signature, no Authenticode/signature ...
CVE-2026-21552
The CVE-2026-21552 entry describes a vulnerability in the modem component where improper input validation could allow a remote denial of service without extra privileges. The impact is rated high (CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with network access and no user interaction required...
CVE-2026-11882
The Builderall for WordPress plugin (pre-3.0.2) has an OAuth flaw where the state value from public OAuth routes is not bound to the initiating user session. This allows unauthenticated attackers to complete the OAuth connection flow and overwrite the stored third‑party integration access token. ...
MAL-2026-11475 Malicious code in pm-claude-skills-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fc0f6d8952f1a97d549799a1e7723dba7a9907b72b0c7a4d097776ddd1d8603 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11467 Malicious code in iac-scanner (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64524c7a0044805e503f398bf4e7f890b40bc3225a8c7576cc71ec9c8a94e378 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-51301
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51299
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51289
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51287
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51286
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2026-51285
DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...