Lucene search
+L

11945 matches found

OSV
OSV
added 2026/07/24 3:23 p.m.13 views

CVE-2026-64230 regulator: tps65219: fix irq_data.rdev not being assigned

In the Linux kernel, the following vulnerability has been resolved: regulator: tps65219: fix irqdata.rdev not being assigned Commit 64a6b577490c "regulator: tps65219: Remove debugging helper function" removed the tps65219getrdevbyname helper along with the irqdata.rdev assignment that depended on...

5.8AI score
SaveExploits0References6
NVD
NVD
added 2026/07/24 7:16 a.m.15 views

CVE-2026-12497

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and...

7.5CVSS0.00238EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/24 6:00 a.m.13 views

EUVD-2026-48488

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 does not consistently enforce the role restriction configured on its front-end registration role-selection field. The set of roles offered to the visitor and...

7.5CVSS5.9AI score0.00238EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/24 6:00 a.m.50 views

CVE-2026-12497

Summary: CVE-2026-12497 affects the Paid Membership Plugin family for WordPress (before 4.16.18). The front‑end registration role-selection restriction is not consistently enforced because two parsers derive the offered roles and the accepted roles, allowing some configurations where the handler ...

7.5CVSS5.4AI score0.00238EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/24 12:32 a.m.11 views

EUVD-2026-48436

9router 0.4.59 fixed in 0.4.60 contains a chain of vulnerabilities: a hardcoded default password 123456 that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn when registering MCP plugins....

9.9CVSS6.3AI score0.01011EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/24 12:32 a.m.18 views

EUVD-2024-55698

Cal.com repository calcom/cal.diy in versions . Booking question form field labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript th...

9.3CVSS5AI score0.00415EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/24 12:00 a.m.17 views

PT-2026-64345

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tps65219 regulator driver where the irq data.rdev variable remains uninitialized for all Interrupt Requests IRQs. This occurs because a previous removal of the...

5.5CVSS5.8AI score0.00121EPSS
SaveExploits0
BDU FSTEC
BDU FSTEC
added 2026/07/24 12:00 a.m.9 views

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware() function in the Django web application framework allows attackers to disclose sensitive information that should be protected.

The vulnerability of the django.middleware.cache.UpdateCacheMiddleware middleware in the Django web application framework is related to improper handling of registrations. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is protected by this middleware...

5.3CVSS5.8AI score0.00285EPSS
SaveExploits0References4Affected Software5
CNVD
CNVD
added 2026/07/24 12:00 a.m.12 views

Apache Fury deserialization vulnerability (CNVD-2026-30659)

Apache Fury is a high-performance serialization framework that supports multiple languages such as Java and C++. It is widely used in distributed systems and message queues to handle cross-language or cross-process data exchanges. Before version 1.4.0, Apache Fury had a deserialization...

9.8CVSS5.9AI score0.00721EPSS
SaveExploits0
NVD
NVD
added 2026/07/23 10:16 p.m.24 views

CVE-2026-63732

9router 0.4.59 fixed in 0.4.60 contains a chain of vulnerabilities: a hardcoded default password 123456 that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn when registering MCP plugins....

9.9CVSS0.01011EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/23 10:16 p.m.19 views

CVE-2024-58353

Cal.com repository calcom/cal.diy in versions . Booking question form field labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript th...

9.3CVSS0.00415EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/23 9:16 p.m.9 views

CVE-2024-58353

Cal.com repository calcom/cal.diy in versions = 4.7.15 is vulnerable to cross-site scripting XSS on the publicly accessible single booking view e.g., /booking/. Booking question form field labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an...

9.3CVSS5AI score0.00415EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/23 9:16 p.m.14 views

CVE-2024-58353 Cal.com through 4.7.15 Cross-Site Scripting via booking questions

Cal.com repository calcom/cal.diy in versions . Booking question form field labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript th...

9.3CVSS5AI score0.00415EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/23 9:33 a.m.10 views

EUVD-2026-47907

The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers...

9.8CVSS5.5AI score0.00712EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/23 9:33 a.m.28 views

CVE-2026-15015

The MountDev AI MCP Connector for WordPress plugin (WordPress) is vulnerable up to version 1.6.1 to an authorization bypass. Unauthenticated attackers can obtain an administrator-bound OAuth Bearer token via a self-registered OAuth client, enabling full administrator-equivalent access to the MCP ...

9.8CVSS5.5AI score0.00712EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/23 12:00 a.m.27 views

PT-2026-64179

Name of the Vulnerable Software and Affected Versions Cal.com versions prior to 4.7.16 Description Cross-site scripting XSS occurs on the publicly accessible single booking view endpoint '/booking/'. The application uses React's dangerouslySetInnerHTML to render booking question form field labels...

9.3CVSS5.9AI score0.00415EPSS
SaveExploits0References7
BDU FSTEC
BDU FSTEC
added 2026/07/23 12:00 a.m.9 views

The vulnerabilities of the functions rxe_mr_alloc() and rxe_mr_init_user() in the driver/infiniband/sw/rxe/rxe_mr.c file of the Linux operating system’s InfiniBand driver module allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the functions rxemralloc and rxemrinituser in the driver/infiniband/sw/rxe/rxemr.c module of the Linux operating system’s InfiniBand driver is related to the repeated release of previously released memory. Exploiting this vulnerability could allow an attacker to compromise th...

7.8CVSS5.9AI score0.00162EPSS
SaveExploits0References7Affected Software2
BDU FSTEC
BDU FSTEC
added 2026/07/23 12:00 a.m.99 views

The vulnerability of the Zabbix Agent 2 component of the Zabbix IT-infrastructure monitoring system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Zabbix Agent 2 component of the Zabbix IT infrastructure monitoring system is related to insufficient protection for registration data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

4.1CVSS5.5AI score0.00229EPSS
SaveExploits0References5Affected Software2
NVD
NVD
added 2026/07/22 9:16 a.m.14 views

CVE-2026-2406

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

6.5CVSS0.00361EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/07/22 8:51 a.m.15 views

EUVD-2026-47621

Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in Client. This issue affects Online Registration and Workflow Management System: through...

6.5CVSS5.2AI score0.00361EPSS
SaveExploits1References1
Rows per page
Query Builder