CVE-2019-25546 NetAware 1.20 Share Name Denial of Service

NetAware 1.20 contains a buffer overflow vulnerability in the Share Name field that allows local attackers to crash the application by supplying an excessively long string. Attackers can trigger a denial of service by pasting a 1000-byte buffer into the Share Name parameter when adding a new shar...

CVE-2019-25547

NetAware 1.20 contains a buffer overflow vulnerability in the User Blocking feature that allows local attackers to crash the application by supplying oversized input. Attackers can paste a malicious buffer of 512 bytes into the 'Add a website or keyword to be filtered' field and trigger a crash...

CVE-2026-1313

creationtimestamp| type| source ---|---|--- 2026-03-21 06:39:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhkgcafysn2y 2026-03-21 10:30:28+00:00| seen| https://infosec.exchange/users/offseq/statuses/116266698540154784 2026-03-21 10:30:30+00:00| seen|...

EUVD-2026-14148

Missing Authorization vulnerability in Northern Beaches Websites WP Custom Admin Interface wp-custom-admin-interface allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Custom Admin Interface: from n/a through = 7.41...

CVE-2026-4261

creationtimestamp| type| source ---|---|--- 2026-03-21 06:00:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116265637003356030 2026-03-21 06:00:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mhke4iyr2y2c 2026-03-21 06:29:31+00:00| seen|...

CVE-2026-4161

The Review Map by RevuKangaroo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

CVE-2026-1093

The WPFAQBlock– FAQ & Accordion Plugin For Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' parameter of the 'wpfaqblock' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied...

CVE-2026-2424

The CVE-2026-2424 entry describes a Stored Cross-Site Scripting vulnerability in the Reward Video Ad for WordPress plugin for WordPress, affecting all versions up to 1.6. The issue arises from insufficient input sanitization and output escaping in admin settings (e.g., Account ID, Message before ...

CVE-2026-1889

CVE-2026-1889 concerns the WordPress Outgrow plugin up to version 2.1, where the stored cross-site scripting vulnerability is triggered by the 'id' attribute of the 'outgrow' shortcode. The root cause is insufficient input sanitization and output escaping on user-supplied attributes. The impact i...

CVE-2026-1889 Outgrow <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'outgrow' Shortcode 'id' Attribute

The Outgrow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the 'outgrow' shortcode in all versions up to, and including, 2.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2026-1378 WP Posts Re-order <= 1.0 - Cross-Site Request Forgery to Settings Update

The WP Posts Re-order plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce validation on the cptpluginoptions function. This makes it possible for unauthenticated attackers to update the plugin settings including...

CVE-2026-1854

The Post Flagger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'flag' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

WordPress plugin myLinksDump SQL注入漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

CVE-2026-33186 gRPC-Go has an authorization bypass via missing leading slash in :path

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 :path pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the :path omitted the mandatory...

webpki: CRLs not considered authoritative by Distribution Point due to faulty matching logic

If a certificate had more than one distributionPoint, then only the first distributionPoint would be considered against each CRL's IssuingDistributionPoint distributionPoint, and then the certificate's subsequent distributionPoints would be ignored. The impact was that correct provided CRLs would...

Vikunja has TOTP Reuse During Validity Window

Summary Any user that has enabled 2FA can have their TOTP reused during the standard 30 second validity window. Details The below code is called when a user that has 2FA is authenticating to the application. Once they submit a valid username-password-totp combination, the user gets authenticated...

SUSE-SU-2026:0950-1 Security update for docker

This update for docker rebuilds it against the current go 1.25 security release...

`tokio-threadpool` is unmaintained

The tokio-threadpool crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

RUSTSEC-2026-0061 `tokio-fs` is unmaintained

The tokio-fs crate is unmaintained. It was part of the Tokio 0.1 ecosystem and has been superseded by the main tokio crate...

CLSA-2026-1774007526 Fix CVE(s): CVE-2026-3731

SECURITY UPDATE: out-of-bounds read in sftp extension name handler - debian/patches/CVE-2026-3731.patch: fix off-by-one bounds check in sftpextensionsgetname and sftpextensionsgetdata - CVE-2026-3731...