295340 matches found
CVE-2026-104065
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap...
CVE-2026-104066
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out...
EUVD-2026-115649
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...
CVE-2026-74846
Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text...
CVE-2026-121554: silkimen cordova-plugin-advanced-http: cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to…
cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or...
Linux Distros Unpatched Vulnerability : CVE-2026-74846
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier...
Headless CMS Plugin information disclosure vulnerability
A security vulnerability exists in Headless CMS Plugin versions 2.0.4 and earlier. This vulnerability stems from improper handling of the postid/postslug parameters in the getrequiredpostdata function within the /wp-json/rae/v1/post endpoint in the REST API component, potentially leading to...
Elasticsearch 8.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 DoS (ESA-2026-235)
The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-235 advisory. - Allocation of Resources Without Limits or Throttling CWE-770 in...
CVE-2026-121509: n/a Headless CMS Plugin: A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function getrequiredpostdata of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument postid/postslug results in information disclosure. The attack may be...
CVE-2026-121546: Novik ruTorrent: ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users…
ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory does not resolve symbolic links. Attackers can submit a datadir path through a symlink under their top directory to create...
PT-2026-136660
A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get required post data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post id/post slug results in information disclosure. The attack may be...
CVE-2026-120597
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...
CVE-2026-120597
The Welcart e-Commerce Plugin for WordPress (versions up to 2.12.6 ) is vulnerable to a remote cross-site scripting (XSS) attack. The issue originates from the ESCOTT_MAIN::error_page_message function within the classes/paymentESCOTT.main.class.php file, where the ResponseCd argument is improperl...
CVE-2026-120597 Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting
A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTTMAIN::errorpagemessage of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched...
SUSE CVE-2026-104063
Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. Attackers can supply a crafted PICT file with manipulated dimensions that, when placed or imported, causes heap over-reads leadi...
SUSE CVE-2026-111487
An out-of-bounds write vulnerability in the Qt Framework assimp scene import plugin of the Qt3D module...
[SECURITY] [DLA 4879-1] strongswan security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4879-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley November 02, 2026 https://wiki.debian.org/LTS -...
Exploit for Improper Encoding or Escaping of Output in Synology Beestation_Os
Synology DSM Vulnerability Detection Scanner This is a scanne...
Malware in atlassian-wallboard-plugin
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
CVE-2026-114715
A flaw was found in Roundcube Webmail. This vulnerability allows an authenticated remote user to take over another account through unauthorized password modification. When a password change is requested, the Modoboa driver in the password plugin selects the first account returned by the API searc...