979756 matches found
CVE-2026-66445
Contributor Cross Site Scripting XSS in Open User Map = 1.4.46 versions...
CVE-2026-66445
Contributor Cross Site Scripting XSS in Open User Map = 1.4.46 versions...
EUVD-2026-49247
Contributor Cross Site Scripting XSS in Open User Map = 1.4.46 versions...
CVE-2026-66445 WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Open User Map = 1.4.46 versions...
CVE-2026-66445
The CVE refers to CVE-2026-66445, describing a Cross Site Scripting (XSS) vulnerability in the WordPress Open User Map plugin, versions
CVE-2026-57916
proCertum SmartSign opens Certificate Practice Statement CPS URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the...
CVE-2026-64531
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nlalen field is u16. Commit a1e64addf3ff "net: openvswitch: remove misbehaving actions length check" allowed the...
CVE-2026-14236 Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect
The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site aft...
CVE-2026-14236
The CVE concerns the Contact Form 7 WordPress plugin (pre-2.5) failing to validate the host of a user-supplied return URL before using it as the success and cancel redirect targets for a Stripe checkout. Root cause: lack of host validation on the return URL enables an unauthenticated attacker to ...
BIT-OPENBAO-2026-39396 OpenBao has Decompression Bomb via Unbounded Copy in OCI Plugin Extraction (DoS)
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, ExtractPluginFromImage in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via io.Copy with no upper bound on the number of bytes written. ...
Apache Struts - Multiple Open Redirection Vulnerabilities
Apache Struts is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input. id: CVE-2013-2248 info: name: Apache Struts - Multiple Open Redirection Vulnerabilities author: 0xAkoko severity: medium description: Apache Struts is prone ...
dovecot: Dovecot: Denial of Service via excessive IMAP bracing
A flaw was found in Dovecot. A remote attacker can exploit this vulnerability by sending excessive open braces over the Internet Message Access Protocol IMAP, leading to uncontrolled memory usage. This can cause the affected system to consume memory up to its configured limit, resulting in a Deni...
CVE-2026-17501 ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion
A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull...
Next.js Framework 12.x < 15.5.21 / 16.x < 16.2.11 SSRF
The Next.js Framework on the remote host is affected by a server-side request forgery vulnerability: - A rewrites or redirects rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's hostname suffix. For a...
RHEL 7 : libreoffice (RHSA-2026:46386)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:46386 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processo...
PT-2026-65034
NGINX Plus and NGINX Open Source have a vulnerability in the ngx http proxy v2 module and ngx http grpc module modules. This vulnerability exists when the proxy http version to 2 or grpc pass directives are used to proxy HTTP/2 traffic, the ignore invalid headers directive is set to off, and the...
libssh2 Double-Free Heap Corruption via sftp_open()
...
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
...
SUSE-SU-2026:22940-1 Security update for libssh
This update for libssh fixes the following issues: - CVE-2026-15370: stack buffer overflow in SFTP server longname construction bsc1272162. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: denial of service via oversized SFTP read length...
SUSE CVE-2026-64298
In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAYWRITE in open permission mask for OTRUNC POSIX requires write permission to truncate a file, so an open that specifies OTRUNC must be authorized for write access regardless of the OACCMODE access mode...