90887 matches found
CVE-2026-20279: Improper Access Control
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. Th...
CVE-2026-82223: Missing Authorization
Unauthenticated Broken Access Control in WP Event SOlution = 4.1.22 versions...
PT-2026-84829
agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scanning by shipping malicious pycache entries alongside benign source files. Attackers can execute arbitrary Python bytecode on import while the scanner reports...
CVE-2026-84662: URL Redirection to Untrusted Site
Jenkins LDAP Plugin 807.809.vd3a4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers to connect to an attacker-specified URL...
CVE-2026-84665: Improper Neutralization of Input During Web Page Generation
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...
CVE-2026-81771: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in TrustedSite = 1.2.5 versions...
CVE-2026-84772: Server-Side Request Forgery (SSRF)
Editor Server Side Request Forgery SSRF in Broken Link Checker = 2.4.14 versions...
CVE-2026-82883: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...
CVE-2025-46418: Improper Neutralization of Special Elements used in an OS Command
Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition...
CVE-2026-81770: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Interactive Geo Maps = 1.6.30 versions...
CVE-2026-84775: Allocation of Resources Without Limits or Throttling
Unauthenticated Denial of Service Attack in Really Simple SSL = 9.8.0 versions...
CVE-2024-7956: Improper Authentication
A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project...
CVE-2026-81294: Incorrect Privilege Assignment
Unauthenticated Privilege Escalation in Authorizer = 3.15.1 versions...
CVE-2024-35585: Missing Authentication for Critical Function
Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication...
CVE-2026-81769: Incorrect Privilege Assignment
Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1...
CVE-2026-76756: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...
CVE-2026-79989: Improper Authorization
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission which doesn’t allow changing...
CVE-2026-76755: Improper Restriction of Operations within the Bounds of a Memory Buffer
Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions:...
CVE-2026-81774: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Product Attachment: from n/a through 2.3.4...