262288 matches found
EUVD-2026-36992
Unauthenticated Sensitive Data Exposure in Amelia = 2.2 versions...
EUVD-2026-36958
Unauthenticated Broken Access Control in Booking Activities = 1.16.48.1 versions...
EUVD-2026-36953
Unauthenticated Cross Site Scripting XSS in Paid Member Subscriptions = 2.17.3 versions...
EUVD-2026-36776
An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Service DoS via a crafted request...
CVE-2026-47825
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x fix 3.1.13. Spring Cloud Gateway 4.1.x fix 4.1.13. Spri...
CVE-2026-42650
Unauthenticated Cross Site Scripting XSS in AutomatorWP = 5.6.7 versions...
CVE-2026-39434
Shop manager PHP Object Injection in CTX Feed = 6.6.26 versions...
CVE-2026-53705
creationtimestamp| type| source ---|---|--- 2026-06-15 20:23:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe4gpjlgt2w...
CVE-2026-42668 WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.18.0 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend = 1.18.0 versions...
CVE-2026-42660 WordPress Contest Gallery plugin <= 28.1.7 - Sensitive Data Exposure vulnerability
Subscriber Sensitive Data Exposure in Contest Gallery = 28.1.7 versions...
CVE-2026-42656
CVE-2026-42656 affects the WordPress Contest Gallery plugin
CVE-2026-40793 WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in Groundhogg 4.4.1 versions...
CVE-2026-53703
creationtimestamp| type| source ---|---|--- 2026-06-15 20:18:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe45dozpw2j...
CVE-2026-54295
creationtimestamp| type| source ---|---|--- 2026-06-15 20:03:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe3cpxdpf2b 2026-07-31 18:35:23+00:00| published-proof-of-concept| https://github.com/nltk/nltk/security/advisories/GHSA-fg7f-2386-8897...
CVE-2026-47261 Wasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restriction
Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 pathopen interfaces by...
PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keys
!NOTE Scored assuming a deployment where algorithm policy functions as an authentication/authorization boundary. In deployments where the algorithm policy enforces crypto agility only, the practical confidentiality impact is lower and the issue is closer to an integrity-of-policy-enforcement bug...
CVE-2026-9260
creationtimestamp| type| source ---|---|--- 2026-06-15 19:00:00+00:00| seen| https://jvn.jp/en/vu/JVNVU98100934 2026-06-16 04:20:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moex3aitgp22...
DEBIAN-CVE-2026-8356
LibreOffice can import presentations in the legacy binary PPT format. A stack buffer overflow existed when importing a colour-replacement record. Two fixed-size colour tables were filled from the file, but the write position was not reset between the two passes over the record, so a file whose...
CVE-2026-47777
Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote accounts consented to be featured in a remote Collection could lead to attackers bypassing the check and faking consent. An attacker could forge the...
