14585 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-81841
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shar...
ROS-20261005-73-0016
The vulnerability in rsync is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...
PT-2026-104776
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality...
ROS-20261005-73-0017
The vulnerability in rsync is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...
PT-2026-104774
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A...
CVE-2026-105148 SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Completion API Endpoint. Such manipulation of the argument generationconfig.apibase leads to server-side request forgery. The...
CVE-2026-105148 SciPhi-AI R2R Retrieval Completion API Endpoint llm.py server-side request forgery
A vulnerability was identified in SciPhi-AI R2R up to 3.6.6. This vulnerability affects unknown code of the file py/shared/abstractions/llm.py of the component Retrieval Completion API Endpoint. Such manipulation of the argument generationconfig.apibase leads to server-side request forgery. The...
[SECURITY] Fedora 45 Update: shared-mime-info-2.5.1-3.fc45
This is the freedesktop.org shared MIME info database. Many programs and desktops use the MIME system to represent the types of files. Frequently, it is necessary to work out the correct MIME type for a file. This is generally done by examining the file's name or contents, and looking up the...
[SECURITY] Fedora 45 Update: libabigail-2.10-4.fc45
The libabigail package comprises seven command line utilities: abidiff, kmidiff, abipkgdiff, abicompat, abidw, and abilint. The abidiff command line tool compares the ABI of two ELF shared libraries and emits meaningful textual reports about changes impacting exported functions, variables and the...
PT-2026-104550
Name of the Vulnerable Software and Affected Versions Burst Statistics – Simple WordPress Analytics Google Analytics Alternative versions prior to 3.7.2 Description Improper authentication allows for account persistence. The maybe load shared dashboard handler issues a genuine WordPress session...
CVE-2026-23937
A flaw was found in Zabbix. Authenticated users can exploit the Zabbix API's host.get action to extract a host's Pre-Shared Key PSK. This could lead to a loss of data integrity, as the extracted key may enable unauthorized access or modification of sensitive information...
CVE-2026-104854
The Nx monorepo solution for TypeScript and polyglot codebases (versions 14.6.0 through 22.7.8 and 23.0.0 through 23.1.1) is vulnerable to local privilege escalation and information disclosure. The software creates Unix domain sockets for its daemon and isolated plugin workers in shared temporary...
httpd: httpd: Authentication bypass via credential replay in mod_auth_digest
A flaw was found in the modauthdigest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce a single-use security token lifetime of...
httpd: httpd: Denial of Service via mod_dav shared lock memory calculation error
A flaw was found in the moddav module of the Apache HTTP Server. This vulnerability allows a Denial of Service DoS by crashing server child processes. An attacker with permission to create Web Distributed Authoring and Versioning WebDAV locks can trigger a memory calculation error during lock...
CVE-2026-85016 Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...
CVE-2026-85016 Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...
CVE-2026-85016
The Unlimited Elements for Elementor WordPress plugin (versions before 2.0.21 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to escape an icon value before concatenating it into an HTML attribute within the shared widget-parameter processor . This flaw allows u...
CVE-2026-73636
A flaw was found in the modauthdigest module of the Apache HTTP Server. This vulnerability allows an attacker positioned on the network to bypass authentication by replaying previously intercepted user credentials. When the server is configured with a nonce a single-use security token lifetime of...
CLEANSTART-2026-DS58516 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello
CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...
CVE-2026-85016: Improper Neutralization of Input During Web Page Generation
The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access who do not hold unfilteredhtml to store a payload that executes when th...