267936 matches found
CVE-2026-74922
The Document Gallery WordPress plugin through 5.1.1 does not verify the signature on one of its unauthenticated webhook endpoints when no shared secret has been configured, which is the default state, allowing unauthenticated users to replace the thumbnail image the site publishes for any documen...
CVE-2026-103311
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...
Astra Linux – vulnerability in gst-plugins-bad1.0
A stack buffer overflow vulnerability was found in GStreamer’s DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without any bounds checking. A remote unauthenticated attacker can send a certificate containing...
Astra Linux – vulnerability in Zabbix
The Zabbix Agent 2 smartctl plugin fails to properly sanitize parameters passed to smart.disk.get, enabling attackers to inject unexpected arguments into the smartctl command. This can be exploited to extract the NTLMv2 hash from a Windows system...
CLSA-2026-1792393388 TuxCare security update for @babel/plugin-transform-unicode-regex (2 CVEs)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...
CLSA-2026-1792393386 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.18.9-tuxcare.3...
CLSA-2026-1792393387 TuxCare security update for @babel/plugin-transform-unicode-regex (2 CVEs)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 2 CVEs. Fixed in 7.21.5-tuxcare.2...
CLSA-2026-1792393383 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.25.7-tuxcare.4...
CLSA-2026-1792393379 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.16.7-tuxcare.3...
CLSA-2026-1792393376 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.21.0-tuxcare.4...
CLSA-2026-1792393378 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.29.0-tuxcare.2...
CLSA-2026-1792393377 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.21.5-tuxcare.1...
CLSA-2026-1792393374 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.18.9-tuxcare.2...
CLSA-2026-1792393375 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.12.18-tuxcare.2...
CLSA-2026-1792393373 TuxCare security update for @babel/plugin-transform-unicode-regex (1 CVE)
TuxCare rebuilt @babel/plugin-transform-unicode-regex to address 1 CVE. Fixed in 7.29.0-tuxcare.1...
WordPress Choose User Role at Registration plugin < 1.3.3 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Choose User Role at Registration versions 1.3.3...
CVE-2026-94294 App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...
CVE-2026-94294 App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...
CVE-2026-94294
The App Builder WordPress plugin (versions 3.8.4 through 5.7.0) contains a vulnerability where the application fails to require authentication or authorization before writing attacker-supplied data to one of its options. In a separate unauthenticated request, the plugin redirects the visitor's br...
EUVD-2026-104107
The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing attacker-supplied data to one of its options and, on a separate unauthenticated request, redirecting the visitor's browser to a URI built from that stored data...