262250 matches found
CVE-2026-44018 Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An attacker could craft malicious METS-GBS...
EUVD-2026-39651
Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/orgId endpoints...
CVE-2026-12411
Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled...
CVE-2026-55200 affecting package libssh2 for versions less than 1.11.1-3
CVE-2026-55200 affecting package libssh2 for versions less than 1.11.1-3. A patched version of the package is available...
CVE-2026-57662
Contributor SQL Injection in Contest Gallery = 30.0.0 versions...
CVE-2026-57650
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.3 versions...
CVE-2026-5757
CVE-2026-5757 concerns Ollama’s model quantization engine. The CERT entry describes an unauthenticated remote information-disclosure vulnerability triggered via the model upload interface. Root cause: three factors—no bounds checking on user-supplied GGUF header metadata, unsafe memory access usi...
CVE-2026-57660
The CVE-2026-57660 entry is supported by connected documents showing an Unauthenticated Broken Access Control flaw in the WordPress Booking and Rental Manager plugin, affecting versions
CVE-2026-57648 WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability
Contributor Broken Access Control in Nelio Content = 4.3.4 versions...
EUVD-2026-39749
Unauthenticated Sensitive Data Exposure in WCBoost Products Compare = 1.1.0 versions...
EUVD-2026-39741
Contributor Cross Site Scripting XSS in Neve PRO = 3.1.2 versions...
EUVD-2026-39728
Contributor Remote Code Execution RCE in Blocksy Companion Pro = 2.1.45 versions...
CVE-2026-56066
CVE-2026-56066 affects the WordPress ShortPixel Adaptive Images plugin up to version 3.11.4, describing an unauthenticated Arbitrary File Deletion vulnerability. The connected records confirm the affected product and the nature of the issue but do not provide details on attack vectors, root cause...
CVE-2026-56041
Summary: CVE-2026-56041 describes an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin “Responsive Lightbox” up to version 2.7.6. The incident is classified with CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-vector XSS that requires user intera...
UBUNTU-CVE-2026-8286
A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not...
CVE-2026-57921
creationtimestamp| type| source ---|---|--- 2026-06-26 13:59:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp743uv2zm27...
WordPress Eagle Booking plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Bonds in WordPress Plugin Eagle Booking versions = 1.3.4.3...
WordPress Child theme Wizard plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Child Theme Wizard versions = 1.4...