CVE-2024-26321

CVE-2024-26321 pertains to vulnerabilities in ownCloud as documented by a pending CVE placeholder linked to real fixes. The connected advisory indicates an Authentication Bypass Using Pre-signed URLs in ownCloud, where improper validation may allow an attacker to bypass authentication and access ...

CVE-2023-44443

CVE-2023-44443 describes a Remote Code Execution in GIMP via PSP file parsing. The root cause is lack of validation of PSP data, causing an integer overflow during memory write. Impact is high: attacker-controlled code executed with the current process, with UI interaction required (user must ope...

CVE-2023-42118

CVE-2023-42118 affects Exim libspf2. The vulnerability arises in the SPF macro parser, where unvalidated user-supplied data can trigger an integer underflow before memory write, enabling remote code execution with the service account context. Exploitation appears feasible by network-adjacent atta...

CVE-2023-42117

CVE-2023-42117 affects Exim (smtp service). Root cause: Improper neutralization/validation of user-supplied data leading to a memory corruption and remote code execution, with no authentication required. Impact: remote code execution in Exim processes, on affected installations. Affected componen...

CVE-2023-37328

GStreamer PGS subtitle parsing flaw (CVE-2023-37328) causes a heap-based buffer overflow that can enable remote code execution. It affects gstreamer1-plugins-base and related GStreamer components; the issue arises from inadequate validation of user-supplied data length during PGS subtitle parsing...

CVE-2023-37327

Consolidated: CVE-2023-37327 targets GStreamer, specifically the FLAC file parsing path. The flaw is an integer overflow while handling FLAC data, leading to a heap overwrite and remote code execution. The issue affects gstreamer1-plugins-good (and related GStreamer components) and has had vendor...

CVE-2023-52220

CVE-2023-52220 is a Missing Authorization/Broken Access Control vulnerability in the WordPress plugin Google Analytics by Monster Insights (versions

CVE-2023-51482

CVE-2023-51482 is an Improper Authentication vulnerability in WordPress Eazy Plugin Manager (affected: versions n/a through 4.1.2). The flaw allows accessing functionality not properly constrained by ACLs, with references explicitly noting an Arbitrary Options Update leading to Remote Code Execut...

CVE-2023-51478

CVE-2023-51478 (Build App Online) is substantiated by connected PT-secure sources: an improper authentication flaw allows unauthenticated privilege escalation leading to potential account takeover in Build App Online versions 1.0.19 and earlier. The affected software is Build App Online; exploita...

CVE-2023-6237

The CVE-2023-6237 entry concerns OpenSSL EVP_PKEY_public_check() performing an expensive verification on RSA public keys. The issue causes long delays (potential DoS) when keys of untrusted provenance are checked, notably when using the OpenSSL pkey tool with -pubin/-check. The impact is describe...

CVE-2023-20249

CVE-2023-20249 affects Cisco TelePresence Management Suite (TMS) web-based management interface. Affected component: the TMS web UI; root cause: insufficient input validation in the interface allows an authenticated, remote attacker to perform cross-site scripting (XSS). Impact: attacker can exec...

CVE-2024-20313

CVE-2024-20313 affects Cisco IOS XE Software, specifically the OSPFv2 feature. The issue arises from improper validation of OSPF updates, allowing an unauthenticated, adjacent attacker to send a malformed OSPF update that can cause the device to reload and trigger a DoS. Connected sources corrobo...

CVE-2023-51472

CVE-2023-51472: Checkout Mestres WP plugin for WordPress (versions 7.1.9.7 (per PT-Security) or follow vendor/NVD advisories for the latest patched version.

CVE-2023-51425

CVE-2023-51425 affects the Rencontre – Dating Site WordPress plugin (

CVE-2023-51405

CVE-2023-51405 concerns the WordPress plugin BookingPress prior to version 1.0.75, where unauthenticated users could manipulate the booking price due to an improper validation in the bookingpress_confirm_booking flow. Affected versions are BookingPress up to 1.0.74; the vulnerability enables pric...

CVE-2022-45852

CVE-2022-45852 is a path traversal vulnerability in the WordPress WP-FormAssembly plugin affecting versions n/a through 2.0.5. It arises from improper limitation of a pathname to a restricted directory, allowing traversal to sensitive files. Documented impacts include (per sources) potential unau...

CVE-2023-44227

CVE-2023-44227 affects WordPress plugin Simple File List (Mitchell Bennis) up to version 6.1.9. Root cause: Missing/insufficient authorization controls allow unauthenticated users to delete arbitrary files via the plugin’s deletion functionality, enabling potential denial of service or data loss....

CVE-2024-2836

The CVE-2024-2836 entry refers to the WordPress plugin “Social Share, Social Login and Social Comments Plugin” (Super Socializer). Version range affected: before 7.13.64. Root cause: the plugin does not sufficiently sanitize/escape certain settings, enabling Cross-Site Scripting (XSS) for high-pr...

CVE-2024-2857

The CVE refers to WordPress plugin Simple Buttons Creator (

CVE-2024-1660

CVE-2024-1660 affects the WordPress Top Bar plugin prior to 3.0.5, where certain settings were not properly sanitised/escaped in the UI, enabling Stored XSS by high-privilege users (e.g., Administrators) even if unfiltered_html is disabled (including multisite setups). The Red Hat advisory mirror...