12638 matches found
CVE-2026-55197 Hermes WebUI < 0.51.443 - Broken Access Control in /api/session Endpoint
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles via GET...
CVE-2026-39559
Unauthenticated Local File Inclusion in Uppercase 1.2.2 versions...
CVE-2026-27410
Unauthenticated Deserialization of untrusted data in Slimstat Analytics 5.4.0 versions...
CVE-2026-39559
CVE-2026-39559 affects WordPress Uppercase theme versions prior to 1.2.2. The vulnerability is an unauthenticated Local File Inclusion (LFI) in the theme, enabling an attacker to access local files. Impact is denoted as high (CVSS 3.1: 8.1) with network attack vector, high complexity, and no user...
postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison
A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts...
postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison
A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts...
CVE-2026-42357 Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access.
Incorrect Authorization vulnerability allows users to access workflow instance information belonging to projects they do not have permission to access. This issue affects Apache DolphinScheduler versions prior to 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes this issue...
CVE-2026-41280
CVE-2026-41280 affects Apache DolphinScheduler prior to 3.4.2. The issue is an Incorrect Authorization vulnerability where users with system login privileges can delete task definitions in unauthorized projects due to insufficient access controls. The documented impact is deletion of task definit...
CVE-2026-9570 Taskbuilder < 5.0.8 - Reflected XSS via Shortcode
The Taskbuilder WordPress plugin before 5.0.8 does not properly sanitise a URL parameter before echoing it into inline JavaScript on a frontend page containing one of its shortcodes, leading to a Reflected Cross-Site Scripting vulnerability that can be triggered against any logged-in user...
PT-2026-50560
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The unarchive internal module's archive extraction commands lack code-level validation for extracted file paths. This causes the module to rely on the behavior o...
ImageMagick < 6.9.13-50 / 7.x < 7.1.2-25 Multiple Vulnerabilities
The remote host has a version of ImageMagick installed that is prior to 6.9.13-50 or 7.x prior to 7.1.2-25. It is, therefore, affected by multiple vulnerabilities, including: - A missing validation in AcquireAlignedMemory could cause memory exhaustion conditions. CVE-2026-53460 - An incorrect loo...
ImageMagick < 6.9.13-49 / 7.x < 7.1.2-24 Multiple Vulnerabilities
The remote host has a version of ImageMagick installed that is prior to 6.9.13-49 or 7.x prior to 7.1.2-24. It is, therefore, affected by multiple vulnerabilities: - A crafted MVG file could result in a stack overflow due to a missing depth or visited-set check. CVE-2026-48734 - An infinite loop ...
CVE-2026-6429 affecting package cmake for versions less than 3.30.3-14
CVE-2026-6429 affecting package cmake for versions less than 3.30.3-14. A patched version of the package is available...
CVE-2026-5545 affecting package curl for versions less than 8.11.1-8
CVE-2026-5545 affecting package curl for versions less than 8.11.1-8. A patched version of the package is available...
CVE-2026-5545 affecting package cmake for versions less than 3.30.3-14
CVE-2026-5545 affecting package cmake for versions less than 3.30.3-14. A patched version of the package is available...
NPM: n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
NPM: n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions vulnerability discovered by ? in WordPress Npm n8n versions 2.25.7...
NPM: n8n: Stored XSS in Chat Trigger Node
NPM: n8n: Stored XSS in Chat Trigger Node vulnerability discovered by ? in WordPress Npm n8n versions 1.123.55...
CVE-2026-39446
The CVE-2026-39446 entry describes an unauthenticated PHP Object Injection in WordPress Kapee theme versions prior to 1.7.0. The root cause is a PHP object injection flaw in the Kapee theme’s code path, enabling an attacker with network access and no user interaction to trigger impact. Impact is ...