61540 matches found
CVE-2026-73060: Allocation of Resources Without Limits or Throttling
Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged...
CVE-2026-17087: Missing Authorization
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
GHSA-C974-W86C-VPFW vulnerabilities
Vulnerabilities for packages: kubeflow-katib, cloudprober, tekton-chains, k8sgpt, metrics-server, minio-object-browser, argo-workflows, tekton-pipelines, tetragon, tkn, cluster-api-azure-controller, verticadb-operator, redis-operator, ko, helm-operator, spegel, prometheus,...
CVE-2026-73043: Improper Neutralization of Input During Web Page Generation
SiYuan versions before v3.7.4 contain a remote code execution vulnerability in the Template calculation operator, which renders user-authored Go templates and stores output verbatim without sanitization. Attackers can inject malicious HTML and JavaScript into template calculations that execute in...
CVE-2026-56862 vulnerabilities
Vulnerabilities for packages: tetragon, tekton-chains, redis-operator, helm-operator, newrelic-nri-statsd, cerbos, cri-tools, neuvector-dbgen, git-lfs, pguser, direnv, kyverno, cue, rabbitmq-messaging-topology-operator, skopeo, hcloud, nri-mysql, influx, portieris, sonobuoy, nats, timoni,...
GO-2026-6090 vulnerabilities
Vulnerabilities for packages: tetragon, tekton-chains, redis-operator, helm-operator, newrelic-nri-statsd, cerbos, cri-tools, neuvector-dbgen, git-lfs, pguser, direnv, kyverno, cue, rabbitmq-messaging-topology-operator, skopeo, hcloud, nri-mysql, influx, portieris, sonobuoy, nats, timoni,...
CVE-2026-71571
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...
CVE-2026-71570
Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration 2.0.0-4.0.11 - A backend operator granted access scoped to comicagenda only could enumerate Joomla user profiles...
CVE-2026-71570 Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11
Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration 2.0.0-4.0.11 - A backend operator granted access scoped to comicagenda only could enumerate Joomla user profiles...
EUVD-2026-58805
Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration 2.0.0-4.0.11 - A backend operator granted access scoped to comicagenda only could enumerate Joomla user profiles...
CVE-2026-71570 Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11
Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration 2.0.0-4.0.11 - A backend operator granted access scoped to comicagenda only could enumerate Joomla user profiles...
CVE-2026-71571
Technical details are not publicly available in the provided documents. Monitor for updates from official sources.
EUVD-2026-58804
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...
CVE-2026-71571
Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL...
CVE-2025-7639
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps"...
CVE-2025-7639
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps"...
CVE-2026-57469
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...
CVE-2026-57469 Cross-Site Request Forgery (CSRF) in KUNBUS PiCtory
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...
