327 matches found
Astra Linux – Vulnerability in ffmpeg
FFmpeg n7.0 is affected by a double-free issue through the rkmppretrieveframe function in libavcodec/rkmppdec.c...
Astra Linux – Vulnerability in Qemu
In QEMU, the softmmu/physmem.c file, versions up to 7.0.0, can perform an uninitialized read on the translatefail path, resulting in an ioreadx or iowritex crash. NOTE: A third-party report states that the “Non-virtualization Use Case” described in the qemu.org reference applies here. In other...
EUVD-2026-55107
Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21082
The CVE-2026-21082 entry identifies a relative path traversal vulnerability in Samsung Health prior to version 7.0.0, allowing local attackers to access sensitive information. Affected software: Samsung Health (pre-7.0.0). Root cause: relative path traversal. Impact: confidentiality of data may b...
CLSA-2026-1783040469 TuxCare security update for 36 packages (1 CVE)
TuxCare rebuilt 36 packages to address 1 CVE. Fixed in 7.0.109-tuxcare.2...
CLSA-2026-1779324473 TuxCare security update for postcss (4 CVEs)
TuxCare rebuilt postcss to address 4 CVEs. Fixed in 7.0.32-tuxcare.1...
CVE-2026-67969
An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...
CVE-2026-15906 Premium Packages <= 7.0.4 - Authenticated (Admin+) SQL Injection via 'orderby' Parameter
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...
Exploit for CVE-2026-63030
wp2shell: WordPress Batch RCE A technical breakdown of CVE-20...
PT-2026-60293
Name of the Vulnerable Software and Affected Versions Zoom Workplace for Windows versions prior to 7.0.0 Zoom VDI Client for Windows versions prior to 7.0.10 Zoom VDI Client for Windows versions prior to 6.6.15 Zoom VDI Client for Windows versions prior to 6.5.18 Zoom Meeting SDK for Windows...
EUVD-2026-43447
Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through = 7.0...
CVE-2026-57371 WordPress WPJAM Basic plugin <= 7.0 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue affects WPJAM Basic: from n/a through = 7.0...
CVE-2026-57372
CVE-2026-57372 is a Server-Side Request Forgery (SSRF) vulnerability affecting the WordPress WPJAM Basic plugin (wpjam-basic) versions up to and including 7.0. The CVE entry states the issue is a SSRF in WPJAM Basic, but the provided documents do not specify the underlying code path, affected fun...
CVE-2026-57371
The CVE-2026-57371 entry describes a Deserialization of Untrusted Data vulnerability in the WordPress WPJAM Basic plugin (wpjam-basic), affecting versions up to 7.0. The underlying issue is object injection via deserialization, enabling an attacker to potentially execute unintended actions throug...
CLEANSTART-2026-NL92777 Security fixes for CVE-2026-42504 applied in versions: 7.0.34-r2
Security vulnerability affects the mongodb package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-59031
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...
PT-2026-57850
Name of the Vulnerable Software and Affected Versions Laravel-Mediable versions prior to 7.0.0 Description An issue exists where unauthenticated attackers can achieve remote code execution by uploading files with double extensions, such as shell.php.jpg. The PATHINFO FILENAME extraction preserves...
EUVD-2026-42637
PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends...
PYSEC-2026-1143 Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions Op or Admin to change the connection object in this...