CVE-2026-14816 The GDPR Framework < 2.4.0 - Unauthenticated Consent Record Forgery and Do Not Sell Requests Spam

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

CVE-2026-10526

The EmbedPress WordPress plugin, in versions prior to 4.6.1 , is vulnerable to an unauthenticated blind Server-Side Request Forgery (SSRF) . The flaw exists because the plugin fails to validate user-supplied URLs before making server-side requests through unauthenticated endpoints. This allows an...

CVE-2026-14816

The GDPR Framework By Data443 WordPress plugin (versions before 2.4.0 ) is vulnerable to an improper access control flaw. The plugin fails to adequately verify the authorization or the identity of the data subject when recording privacy requests or cookie-consent choices. This allows unauthentica...

CVE-2026-14816

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

CVE-2026-18569

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature...

CVE-2026-18569

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature...

ALPINE-CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

PT-2026-67676

The background service of ABP or AES runs as NT AUTHORITYSYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

PT-2026-74969

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.32.3.post2+tuxcare...

The vulnerability of the library for web requests, node-XMLHttpRequest, related to errors in the certificate validation process, allows a perpetrator to trigger a service failure.

The vulnerability of the node-XMLHttpRequest library for web requests is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2026-67858

Buffer Overflow vulnerability exists in open62541 1.5.5 when the Local Discovery Server LDS is built with multicast discovery enabled through the MDNSD backend. An unauthenticated remote attacker can send a RegisterServer or RegisterServer2 request containing many unique discoveryUrls. This allow...

CVE-2026-24079: Missing Authentication for Critical Function

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters...

CVE-2026-70480: Server-Side Request Forgery (SSRF)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.34 until 0.11.0, Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer browser without a restricted resource loader. Any user who can place such ...

PT-2026-67833

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.6.34 through 0.10.x Description Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. This allows a user to place a...

PT-2026-73834

TuxCare rebuilt requests to address 1 CVE. Fixed in 2.32.3.post1+tuxcare...

PT-2026-67647

The GDPR Framework By Data443 WordPress plugin before 2.4.0 does not properly verify authorization or the identity of the data subject when recording cookie-consent choices and privacy requests, allowing unauthenticated attackers to forge consent records for arbitrary email addresses and to flood...

PT-2026-67931

Summary Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user's browser issue attacker-chosen outbound GET...

CVE-2026-67858

The CVE affects open62541 1.5.5 when the Local Discovery Server (LDS) is built with multicast discovery enabled via the MDNSD backend. A remote unauthenticated attacker can send RegisterServer or RegisterServer2 requests containing many unique discoveryUrls, triggering a denial-of-service. This i...

CVE-2026-67856

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItemsSampling, Publish, TransferSubscriptions, and DeleteSubscriptions requests...

PT-2026-67641

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw exists in the backchannel logout endpoint of the keycloak-services component, which manages authentication and session management. When an OpenID Connect OIDC identit...