10270 matches found
CVE-2026-0673
The CVE concerns the WordPress plugin Element Pack Addons for Elementor (affecting versions up to 8.3.15). It describes an email header injection vulnerability in the element_pack_contact_form AJAX action caused by insufficient sanitization of newline characters in user-provided input, allowing u...
EUVD-2026-53870
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...
CVE-2026-0673 Element Pack Addons for Elementor <= 8.3.15 - Unauthenticated SMTP Header Injection
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...
WordPress Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons plugin <= 8.3.15 - Unauthenticated SMTP Header Injection vulnerability
Unauthenticated SMTP Header Injection vulnerability discovered by Drew Webber mcdruid in WordPress Plugin Element Pack Elementor Addons versions = 8.3.15...
CVE-2026-0673: Improper Neutralization of CRLF Sequences
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the elementpackcontactform AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated...
EulerOS 2.0 SP15 : golang (EulerOS-SA-2026-2885)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to...
The vulnerability of the spectre_bhb_loop_affected() function in the arch/arm64/kernel/proton-pack.c module, which is part of the ARM 64-bit kernel support for the Linux operating system, allows a hacker to trigger a service failure.
The vulnerability of the spectrebhbloopaffected function in the arch/arm64/kernel/proton-pack.c module, which is part of the ARM 64-bit kernel support for the Linux operating system, relates to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to cau...
CVE-2026-65502: Authentication Bypass by Spoofing
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...
EulerOS 2.0 SP15 : golang (EulerOS-SA-2026-2926)
According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to...
Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVE-2026-8646, CVE-2026-9320, CVE-2026-9071)
Summary IBM WebSphere Application Server Liberty are affected by HTTP request smuggling and a denial of service. This affects IBM WebSphere Application Server Liberty with the servlet-3.0, servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, servlet-6.1, websocket-1.0, websocket-1.1, websocket-2.0...
Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVE-2026-50645, CVE-2026-9322, CVE-2026-9171)
Summary IBM WebSphere Application Server Liberty using the jaxrs-1.1, jaxrs-2.0, jaxrs-2.1, restfulWS-3.0, restfulWS-3.1 , restfulWS-4.0, json-1.0, jsonp-1.0, jsonp-1.1, jsonp-2.0, jsonp-2.1, jaxws-2.2, xmlWS-3.0, and xmlWS-4.0 features is affected by uncontrolled resource consumption and denial ...
Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected affected by a server-side request forgery vulnerability (CVE-2026-11546)
Summary IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Test...
Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by an authorization bypass vulnerability (CVE-2026-11714)
Summary IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability with the apiDiscovery-1.0 feature enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Test...
Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty are affected by a security bypass vulnerability (CVE-2026-10842)
Summary IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability with the appSecurity-1.0, appSecurity-2.0 , appSecurity-3.0 or appSecurity-4.0 feature enabled. Following IBM Engineering Lifecycle Management products are vulnerable ...
Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by a security bypass vulnerability (CVE-2026-10842)
Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM Cloud Pak for Applications, are affected by a security bypass vulnerability with the appSecurity-1.0, appSecurity-2.0 , appSecurity-3.0 or appSecurity-4.0 feature enabled. Vulnerability...
Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation (CVE-2026-14446)
Summary IBM WebSphere Application Server, which is bundled with IBM Cloud Pak for Applications, is affected by a privilege escalation vulnerability. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products and...
K000162741: Ruby on Rails Action Pack vulnerability CVE-2026-66066
Security Advisory Description Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operations marked unsafe for untrusted content, allowing a crafted upload to invoke such an operation...
cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction
A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...
cmd/go: golang: Go tool pack: Arbitrary file write via malicious archive extraction
A flaw was found in the "go tool pack" subcommand, a component of the Go programming language tools. This vulnerability allows an attacker to craft a malicious archive file. When this archive is extracted using the "pack" subcommand, it can lead to arbitrary file writes on the filesystem,...
CVE-2026-57432
A flaw was found in Perl. An integer overflow vulnerability in the Smeasurestruct function, specifically when handling pack and unpack templates with large repeat counts, can lead to an out-of-bounds heap read. This allows an attacker, by providing a specially crafted template, to read sensitive...