261922 matches found
CVE-2026-65552
Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...
DEBIAN-CVE-2026-34502
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...
ALPINE-CVE-2025-49506
APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...
CVE-2026-10535
creationtimestamp| type| source ---|---|--- 2026-08-06 15:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msgcyvmwba2n...
CVE-2026-66843
CVE-2026-66843 affects html_sanitize_ex HTML5 scrubber. The vulnerability arises because the object element (data attribute) is not registered in allow_tag_with_uri_attributes/3, and the only guard is a lowercase javascript: prefix. This allows attacker-supplied content to be embedded in a truste...
CVE-2025-49506 Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...
CVE-2026-32327 Apache Portable Runtime Utility: apr-util XML stack recursion crash
A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...
CVE-2026-65560 WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...
CVE-2026-28178 WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting XSS in Powerkit = 3.1.0 versions...
CVE-2026-58043
A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories. Mitigation Avoid enabling the Node.js Permission Model by not using the --permission flag when starting Node.js applications. This...
Azure Logic Apps Information Disclosure Vulnerability
Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network...
Application Insights Profiler Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory 'path traversal' in Application Insights Profiler allows an authorized attacker to elevate privileges over a network...
CVE-2026-52466
creationtimestamp| type| source ---|---|--- 2026-08-06 13:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msg5oy5zy22s...
CVE-2026-66733
creationtimestamp| type| source ---|---|--- 2026-08-06 13:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117048804948021339 2026-08-06 13:30:27+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3msg5m2k3dm27...
CVE-2026-16316 Malformed IEC 61850 Sampled Values frames cause partial denial of service in StationGuard
OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values SV frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traffic. The vulnerability does not affect...
EUVD-2026-53874
Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7...
CVE-2026-5158
creationtimestamp| type| source ---|---|--- 2026-08-06 12:22:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ipkrbhjyaww72 2026-08-07 05:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mshsfbxb772r...
CVE-2026-55978
creationtimestamp| type| source ---|---|--- 2026-08-06 11:35:25+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msfx6ex55t2b...
CVE-2026-63687 Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...
CVE-2026-63687 Apache CXF: JwtRequestCodeFilter silently overrides outer PKCE and nonce parameters
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...