316837 matches found
Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item bsc1255703. CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort pat...
SUSE-SU-2026:3790-1 Security update for the Linux Kernel
The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item bsc1255703. - CVE-2025-68818: scsi: Revert 'scsi: qla2xxx: Perform lockless command completion in abort...
CVE-2026-77824
The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-19949
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
BIT-KEYCLOAK-2026-9800 Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...
BIT-KEYCLOAK-2026-9083 Keycloak: keycloak: information disclosure through arbitrary filesystem path probing
A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining...
BIT-KEYCLOAK-2026-4634 Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect OIDC token endpoint. This leads to high resource consumption and prolonged processing times, ultimate...
BIT-KEYCLOAK-2026-37978 Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api
A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID userId parameter. This vulnerability allows for cross-role personally identifiable information PII leakage,...
EUVD-2026-65459
The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-77824 Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-77824 Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter
The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-77824
Media Sweep – WordPress Media Cleaner (all versions up to and including 1.1.3 ) is affected by a SQL Injection vulnerability in the 'fields' parameter of its REST API. The root cause is insufficient escaping of the user-supplied parameter combined with lack of proper query preparation, as seen in...
CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
EUVD-2026-65463
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-19949 All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...
CVE-2026-19949
The All-in-One WP Migration and Backup WordPress plugin (all versions up to and including 7.109 ) is susceptible to a second-order SQL injection in its archive restore functionality, caused by insufficient escaping of a user-supplied parameter and inadequate preparation of the existing SQL query....
CVE-2026-75908 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter
The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...
CVE-2026-75908 Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter
The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...
CVE-2021-21551
CVE-2021-21551 Einfacher PoC zur Ausnutzung von CVE-2021-21551 für LPE durch Starten von system cmd. https://vulners.com/cve/CVE-2021-21551 Es wurde ein Problem im signierten Dell-Windows-Treiber dbutil23.sys entdeckt, das zur Kompromittierung des gesamten lokalen Systems führen kann. Die...
EUVD-2026-65356
The Readabler plugin for WordPress is vulnerable to SQL Injection in all versions up to 2.0.18 exclusive due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append...