980782 matches found
CVE-2026-39484 WordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerability
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from n/a through 7.0.00...
LLMtary
LLMtary Elementary — AI-Powered Penetration Testing Platform...
Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access OIDC Provider
Summary Security vulnerabilities have been addressed in IBM Verify Identity Access OIDC Provider Vulnerability Details CVEID:CVE-2026-24051 DESCRIPTION: OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking...
Not Failing Securely ('Failing Open')
Overview rack-session is a session implementation for Rack. Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' in the Rack::Session::Cookie function when it is configured with the secrets: option. An attacker can gain unauthorized access or escalate privileges...
PT-2026-31451
FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 2.3.0, the mcp-from-openapi library uses @apidevtools/json-schema-ref-parser to dereference $ref pointers in OpenAPI specifications without configuring any URL restrictions or custom resolvers. A malicious OpenA...
OpenSSL Toolkit 3.0.20
OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide. This is the 3.0 LTS release...
OpenSSL Toolkit 3.3.7
OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide. This is the 3.3 release...
VulGD: A LLM-Powered Dynamic Open-Access Vulnerability Graph Database
Software vulnerabilities continue to pose significant threats to modern information systems, requiring a timely and accurate risk assessment. Public repositories, such as the National Vulnerability Database and CVE details, are regularly updated, but predominantly utilize relational data models...
PT-2026-31418
Name of the Vulnerable Software and Affected Versions Zammad versions prior to 7.0.1 and prior to 6.5.4 Description The OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This could allow an attacker to potentially compromise...
QD 安全漏洞
QD is a task scheduling and automatic execution tool developed by QD OpenSource. There is a security vulnerability in QD 20230821, which stems from a specially crafted request and may lead to server-side request forgery...
OpenSSL Toolkit 3.5.6
OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer and Transport Layer Security protocols with full-strength cryptography world-wide. This is the 3.5 LTS release...
Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006611)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006611 advisory. In configfsopenfile of file.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System...
Vulnerability of the ngx_mail_smtp_module module in NGINX Plus and NGINX Open Source HTTP servers, allowing attackers to compromise the integrity of protected information.
The vulnerability of the ngxmailsmtpmodule module in NGINX Plus and NGINX Open Source servers is related to the failure to take measures to neutralize CRLF sequences. Exploiting this vulnerability can allow a remote attacker to compromise the integrity of the protected information...
Vulnerability of the ngx_http_mp4_module in NGINX Plus and NGINX Open Source HTTP servers, allowing attackers to cause service failures or execute arbitrary code.
The vulnerability of the ngxhttpmp4module in NGINX Plus and NGINX Open Source HTTP servers is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...
The vulnerability of the ngx_stream_ssl_module module in NGINX Plus and NGINX Open Source HTTP servers allows attackers to bypass security restrictions and gain unauthorized access to protected information.
The vulnerability of the ngxstreamsslmodule module in NGINX Plus and NGINX Open Source HTTP servers is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information...
PT-2026-31562
Open AI models detect vulnerabilities by analyzing code, configs, and system behavior step-by-step—like spotting the FreeBSD zero-day CVE-2024-47467 in the Mythos showcase. Even a 3B open model nailed it, matching bigger ones. The chart shows rankings flip across tasks: OWASP easy stuff vs. gnarl...
monetr 授权问题漏洞
Monetr is an open-source personal budget management application developed by Monetr. Versions of Monetr prior to 1.12.3 had an authorization issue vulnerability. This vulnerability stemmed from a transaction integrity flaw, which could lead to bypassing deletion protection...
Broken Quantum: A Systematic Formal Verification Study of Security Vulnerabilities across the Open-Source Quantum Computing Simulator Ecosystem
Quantum computing simulators form the classical software foundation on which virtually all quantum algorithm research depends. We present Broken Quantum, the first comprehensive formal security audit of the open-source quantum computing simulator ecosystem. Applying COBALT QAI -- a four-module...
PT-2026-31123
CVE-2026-39484 URL Redirection to Untrusted Site 'Open Redirect' vulnerability in John Darrel Hide My WP Ghost hide-my-wp allows Phishing.This issue affects Hide My WP Ghost: from… https://t.co/omlG1NbySg...
PT-2026-31433
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any us...