9827 matches found
CVE-2026-82925: Deserialization of Untrusted Data
The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or...
CVE-2026-80352: Improper Control of Generation of Code
Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges o...
CVE-2026-88867: Improper Neutralization of Input During Web Page Generation
WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...
CVE-2026-87107: Incorrect Authorization
Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with service:write or node:write permission may exploit this issue to remove services, checks, or nodes...
PT-2026-89302
Name of the Vulnerable Software and Affected Versions Apache Camel K versions 2.0.0 through 2.9.2 Apache Camel K versions 2.10.1 through 2.10.1 Description A YAML injection issue in the custom resource configuration allows an authorized author to inject arbitrary Kubernetes objects. This can lead...
Improper Enforcement of a Single, Unique Action
Overview pocketmine/pocketmine-mp is a highly customisable, open source server software for Minecraft: Bedrock Edition written in PHP Affected versions of this package are vulnerable to Improper Enforcement of a Single, Unique Action in the handling of ResourcePackClientResponsePacket packets wit...
CVE-2026-86198
PocketMine-MP versions before 5.44.2 are vulnerable to a denial-of-service condition in the resource pack handling subsystem. The root cause is a failure to properly validate multiple ResourcePackClientResponsePacket packets carrying the STATUS_COMPLETED status, which allows malicious clients to ...
CVE-2026-86198 PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket
PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...
CVE-2026-86198 PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket
PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...
CVE-2026-87930: Deserialization of Untrusted Data
MaxSite CMS through 109.6 passes the cisession cookie to unserialize without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies using the hardcoded encryption key to trigger magic methods and corrupt application state or achieve...
CVE-2026-86198: Improper Enforcement of a Single, Unique Action
PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...
GHSA-G6GW-C38X-MQFC Hono: Unbounded dot-notation nesting in `parseBody()` can cause memory exhaustion
Summary When parseBody expands dot-separated form field names into nested objects, it does not limit the nesting depth or the total number of objects created. A request body well within a normal size limit can therefore allocate an object graph far larger than the request itself, and concurrent...
SUSE CVE-2026-82312
OpenVPN 2.0.0 through 2.6.22 and 2.7alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects...
Microsoft Windows UMPDDrvStretchBltROP Improper Object Management Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the win32kfull...
Microsoft Windows UMPDDrvStretchBlt Improper Object Management Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the win32kfull...
PT-2026-88162
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level configuration files in Jenkins such as the global configuration and jobs can appear as nested field values in user-submitted config.xml documents and subsequently...
CVE-2026-82312
A flaw was found in OpenVPN on Windows. A local authenticated user could exploit a vulnerability related to a NULL Discretionary Access Control List DACL on named Inter-Process Communication IPC objects. This could allow the user to cause a denial of service, making the service unavailable to...
CVE-2026-82312
OpenVPN 2.0.0 through 2.6.22 and 2.7alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NULL DACL on named IPC objects...
CVE-2026-82312
OpenVPN versions 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows are vulnerable to a denial of service caused by a NULL DACL on named IPC objects . Local authenticated users can exploit this to disrupt service. The CVSS 4.0 base score is 1.8 (LOW) , with a local attack vector requiri...
